OpenID Connect SSO
Industry-standard OIDC protocol means FamilySSO works with virtually every modern app — Nextcloud, Gitea, Home Assistant, Immich, and thousands more.
The open-source, free Identity Provider for tech-oriented families and individuals who own their domains—without the hassle of hosting it yourself.
FamilySSO is a lean, privacy-respecting identity platform. No telemetry, no data harvesting, no third-party dependencies you didn't choose.
Industry-standard OIDC protocol means FamilySSO works with virtually every modern app — Nextcloud, Gitea, Home Assistant, Immich, and thousands more.
Agentically coded and relentlessly audited by Opus 4.6 and Gemini 3.1 Pro to strictly adhere to the highest security standards and best practices.
Group family members into tenants. Manage who has access to which apps. Give each family member their own secure account under your roof.
Tenant-level encryption protects your data. A robust master key splitting process ensures maximum protection. All user information is encrypted by a unique key.
Built exclusively on stateless, serverless architecture to ensure immediate response times, infinite scalability, and resilient built-in defenses against DDoS attacks.
Your identity data stays in your account. No SaaS vendor holds your family's credentials. You own the keys, literally and figuratively.
Authentication flows happen at auth.familysso.com — a dedicated, hardened endpoint that handles all OIDC exchanges and user sessions.
Any OIDC-compatible app — Nextcloud, Gitea, Home Assistant — redirects you to FamilySSO to authenticate.
Enter your email, password, and TOTP code. Your credentials are verified cryptographically and instantly, without ever exposing plaintext secrets.
FamilySSO issues a signed ID token and returns you to the app. No passwords shared with the app. Clean, scoped, revocable access.
Every security decision was made deliberately — not as an afterthought. Here's what protects you.
FamilySSO uses a sophisticated Master Key Derivation structure (HKDF) to isolate per-tenant Data Encryption Keys. All your personal data is bound by a unique 512-bit key context.
Distributed rate limiting throttles login attempts per IP. Brute-force and credential stuffing attacks are blocked at the edge before your app ever sees them.
All form endpoints carry CSRF tokens. Strict Transport Security, Content-Security-Policy, and X-Frame-Options headers are sent on every response.
Powered exclusively by strictly defined WebCrypto 512-bit variants: PBKDF2-SHA512 for passwords, HMAC-SHA512 for TOTP and Blind Indexes, and AES-256-GCM for encrypted fields.
Your account is waiting. Sign in to the portal or reach out to your family administrator.