Datum Auth UI

Authentication for Datum Cloud

---

About

Datum Auth UI is the login experience for Datum Cloud, served at /id. It replaces Zitadel's hosted login with a fully-owned React application built on the Datum stack, talking to Zitadel over its v2 APIs.

Every authentication ceremony — password, passkey, MFA, SSO, device authorization, password reset — is implemented here, behind a provider seam that keeps Zitadel out of the routes and flows.

Key Features

• Complete auth ceremonies — password, passkeys/WebAuthn, TOTP and OTP, email link, device authorization, password reset and change
• SSO with identity linking — Google and GitHub identity providers, auto-create, explicit link and unlink ceremonies
• Provider seam — routes and resources depend on an AuthProvider interface, never on Zitadel directly, so the identity backend stays swappable
• Security by default — signed sessions, CSRF protection, rate limiting, strict CSP and secure headers, fraud signals
• Internationalized — Lingui message catalogs with locale detection
• Production-tested — Cypress component, end-to-end, and real-Zitadel acceptance suites

Built With

• Bun — runtime and package manager
• React Router 7 — SSR framework mode
• Hono — backend-for-frontend server
• Zitadel — identity platform (v2 APIs)
• Tailwind CSS + datum-ui — styling and components
• Lingui — internationalization
• Cypress — component, e2e, and acceptance testing

---

Quick Start

bun install
cp .env.example .env    # set SESSION_SECRET, ZITADEL_API_URL, ZITADEL_SERVICE_USER_TOKEN, PUBLIC_ORIGIN
bun run dev

No Zitadel to hand? Run against the built-in fake provider: AUTH_PROVIDER=fake bun run dev

---

Documentation

Full documentation lives in docs/README.md — architecture, configuration, development guides, and operations.

---

License

MIT