Open-source self-hosted IAM with SPID, CIE, FAPI 2.0, eIDAS 2.0, passkeys and AI agent support. The EU-native alternative to Auth0 and Keycloak. Tested against the official OpenID Foundation conformance suite β FAPI 2.0 98%, OID4VCI/OID4VP 100%, 0 fails.
No reviews yetBe the first to leave a review for Clavex
Maker
π
Hey Product Hunt π
I'm a Cloud Architect working across banking and public sector
projects, and kept hitting the same wall: every self-hosted IAM
(Keycloak, Authentik, Zitadel) is solid for standard OIDC/SAML,
but none of them natively support the EU digital identity stack β
SPID (Italy), CIE, eIDAS 2.0, or FAPI 2.0 for open banking.
So I built Clavex β self-hosted, written in Go, single binary,
Docker Compose in ~5 minutes. Also available as SaaS if you don't
want to run it yourself.
Tested against the official OpenID Foundation conformance suite:
558/568 tests passed, 0 fails. FAPI 2.0 at 98%, OID4VCI/OID4VP at 100%.
Honest caveat: it's young. I'm the primary maintainer with a
couple of contributors starting to help out, and there's no
third-party security audit yet β wouldn't recommend it for
production banking use without one.
Would love your feedback, especially if something feels wrong
architecturally or if the docs are confusing. That's more useful
to me right now than praise π
GitHub: github.com/clavex-eu/clavex
Discord: discord.gg/WT8pRXHgjC
Report
The FAPI 2.0 conformance scores are impressive, especially for something self-hosted. Curious how heavy the resource footprint is compared to Keycloak.
Report
Maker
@dilci75504Β Actually have real numbers on this: Keycloak and Clavex have been running side-by-side in the same k8s cluster for the last 30 days, so I pulled the actual container metrics:
Keycloak: ~290-420 MiB memory working set, ~275-425 MB RSS Clavex: ~16-28 MiB memory working set, ~7-11 MB RSS
Roughly 15-20x lower memory footprint in this environment. CPU usage is comparable between the two, so it's really a memory/JVM-overhead story more than a compute one β makes sense given Keycloak's JVM baseline vs Clavex's single static Go binary.
Please note that this isn't a controlled benchmark under identical load, it's real (if low-traffic) production monitoring data from the same cluster (Clavex's data also includes the periods during which multiple conformance tests were performed)
The FAPI 2.0 conformance scores are impressive, especially for something self-hosted. Curious how heavy the resource footprint is compared to Keycloak.
@dilci75504Β Actually have real numbers on this:
Keycloak and Clavex have been running side-by-side in the same k8s cluster for the last 30 days, so I pulled the actual container metrics:
Keycloak: ~290-420 MiB memory working set, ~275-425 MB RSS
Clavex: ~16-28 MiB memory working set, ~7-11 MB RSS
Roughly 15-20x lower memory footprint in this environment. CPU usage is comparable between the two, so it's really a memory/JVM-overhead story more than a compute one β makes sense given Keycloak's JVM baseline vs Clavex's single static Go binary.
Please note that this isn't a controlled benchmark under identical load, it's real (if low-traffic) production monitoring data from the same cluster (Clavex's data also includes the periods during which multiple conformance tests were performed)