Authentication for Datum Cloud
Datum Auth UI is the login experience for Datum Cloud, served at /id. It replaces Zitadel's hosted login with a fully-owned React application built on the Datum stack, talking to Zitadel over its v2 APIs.
Every authentication ceremony — password, passkey, MFA, SSO, device authorization, password reset — is implemented here, behind a provider seam that keeps Zitadel out of the routes and flows.
- Complete auth ceremonies — password, passkeys/WebAuthn, TOTP and OTP, email link, device authorization, password reset and change
- SSO with identity linking — Google and GitHub identity providers, auto-create, explicit link and unlink ceremonies
- Provider seam — routes and resources depend on an
AuthProviderinterface, never on Zitadel directly, so the identity backend stays swappable - Security by default — signed sessions, CSRF protection, rate limiting, strict CSP and secure headers, fraud signals
- Internationalized — Lingui message catalogs with locale detection
- Production-tested — Cypress component, end-to-end, and real-Zitadel acceptance suites
- Bun — runtime and package manager
- React Router 7 — SSR framework mode
- Hono — backend-for-frontend server
- Zitadel — identity platform (v2 APIs)
- Tailwind CSS + datum-ui — styling and components
- Lingui — internationalization
- Cypress — component, e2e, and acceptance testing
bun install
cp .env.example .env # set SESSION_SECRET, ZITADEL_API_URL, ZITADEL_SERVICE_USER_TOKEN, PUBLIC_ORIGIN
bun run devNo Zitadel to hand? Run against the built-in fake provider: AUTH_PROVIDER=fake bun run dev
Full documentation lives in docs/README.md — architecture, configuration, development guides, and operations.