ORBIT
Enterprise authorization for multi-tenant applications
Role-based access control, OAuth2 token issuance, runtime policy evaluation, and audit logging — built for teams that need fine-grained permissions across tenant boundaries.
The Platform
Orbit Service
Multi-tenant IAM engine with RBAC, direct permissions, hierarchical tenants, and a real-time introspect hot path.
Learn more →Orbit OAuth2
Headless OAuth2 authorization server with PKCE, ES512 JWTs, refresh token rotation, and pluggable consent.
Learn more →Orbit SDK
Typed TypeScript client wrapping every management endpoint. Discriminated unions — no try/catch, no surprises.
Learn more →Orbit Dash
Server-rendered admin dashboard for managing tenants, users, roles, and OAuth2 clients. Bootstrap 5 + HTMX.
Learn more →Architecture
Orbit runs as four cooperating services behind nginx, sharing a single PostgreSQL database on Neon:
| Service | Port | Role |
|---|---|---|
| orbit-introspect | 3000 | Hot-path authorization checks (POST /check) |
| orbit-service | 3001 | Management API — users, roles, tenants, policies |
| orbit-dash | 3002 | Server-rendered admin UI and OAuth2 CAS |
| orbit-oauth2 | 3003 | Headless OAuth2 / OIDC authorization server |
All services are built with Bun + TypeScript. The dashboard uses orbit-sdk as its sole API client.