Qavren Auth
Keycloak with a realm per app, provisioned as code. New app, new isolated user pool, sixty seconds.
Every new product needs login on day one. Building it each time is waste; sharing one user pool across unrelated products is a liability. Qavren Auth is the middle path.
What it is
Qavren Auth is self-hosted identity for every Qavren app. Keycloak 26 is the engine. This is the part that matters to us: one realm per app, provisioned as code, with per-stack SDKs and the operations around it.
The identity model is deliberate — one realm per app, isolated user pools, no cross-app SSO. A TrailTold account is not a HaulCall account. That is a feature, not an oversight. The master realm is admin-only.
What it does well
A new app gets auth in about a minute. One provisioning command generates the app's realm definition from a template and applies it idempotently. The generated file gets committed — realm configuration is code, reviewed like code.
Public PKCE by default, confidential by opt-in. Each realm gets one public PKCE client. An app that runs entirely server-side can opt into a second, secret-bearing client — explicitly, on both ends, with the trade-off documented.
SDKs that fail closed. Three thin per-stack wrappers, one convention. Each validates tokens against its realm's JWKS endpoint — no custom cryptography — and returns 401 on any error rather than guessing.
Social sign-in without per-app setup sprawl. One shared Google OAuth client across realms; Sign in with Apple per-app, via a pinned provider extension installed by an init container.
Tested shape, tested idempotency. A Pester suite asserts realm structure and verifies that re-running provisioning changes nothing.
What runs on it
TrailTold (with Google and Apple sign-in, plus a verified Android App Link redirect), Talebound, Roast and Resolve, and the test realms behind the SDK suite. New apps get enrolled at the point they need their first login.
What it looks like in practice
A product needs auth. One command creates its realm, its client, and its redirect URIs, and prints what to store. The app pulls in the SDK for its stack, points at the realm, and validates tokens against JWKS. Nothing was hand-clicked in an admin console, and the realm's entire configuration is a reviewable file in git.
What it's not
It's not a single sign-on layer. Cross-app SSO is explicitly off the table; isolation is the design.
It's not an identity product. It's infrastructure for one portfolio.
Status
In production and actively serving apps. Recent work has been enrollment — a realm for Roast and Resolve, Google sign-in for TrailTold and its test realm, an Android App Link redirect registered for TrailTold mobile, and an Apple signing key rotation. Tech: Keycloak 26 + Postgres via Docker Compose, keycloak-config-cli for idempotent application, PowerShell provisioning tooling, Pester tests.