One server, all your apps
Unlimited projects per instance, each a fully isolated tenant. Nothing is shared across projects unless you are looking at the admin console.
Open-source authentication server
Authentication for all your apps. One small binary.
Run one server. Every app you ship — mobile or web — gets its own users, keys, branded login and subscriptions. Just add a project.
brew install aloisdeniel/tap/mothcurl -fsSL https://raw.githubusercontent.com/aloisdeniel/moth/main/website/public/install.sh | shmacOS and Linux · a single static binary, no dependencies. The script verifies checksums and installs the latest signed release (first tag: v1.0).
How it works
Zero to a logged-in app in three steps.
No SDK keys to provision in a console, no backend to stand up. Run the binary, create a project, point your app at it — Flutter on mobile, React on the web.
Run the binary
Embedded database, admin console, and SDK hosting — all inside one process. No external services to wire up.
moth serve --data-dir ./data
# listening on :8080 · admin console at /adminCreate a project
Each app is a sealed tenant with its own users, ES256 signing keys, providers, and login branding. From the admin or the CLI.
moth project create "Bird Spotter"
# created bird-spotter · pk_bird_c81f2a9d4eAdd the SDK
Both SDKs are served from your instance — pub for Flutter, npm for React. Wrap your app and you have a themed login screen.
dependencies:
moth_auth:
hosted: https://auth.example.com/pub
version: ^1.0.0runApp(MothApp(
config: MothConfig(
endpoint: Uri.parse('https://auth.example.com'),
publishableKey: 'pk_bird_c81f2a9d4e',
),
child: MyApp(),
));@moth:registry=https://auth.example.com/npm
# then: npm install @moth/reactcreateRoot(document.getElementById('root')!).render(
<MothProvider
config={{
endpoint: 'https://auth.example.com',
publishableKey: 'pk_bird_c81f2a9d4e',
}}
>
<App />
</MothProvider>,
)Features
One server, all your apps.
An indie, a studio, or an agency runs a single instance; every app is just another project on it. Adding app #10 costs what app #1 did.
Analytics
Signups, logins, active users, methods and platforms — per project, stored in your own database.
Branded login, light and dark
A design-system editor themes each project's login screens — colors, font, spacing, logo. The SDK renders them, light and dark.
Per-app isolated users
Users belong to exactly one project. The same email in two apps is two unrelated accounts, with unrelated sessions.
Email, Google & Apple
Email/password plus Sign in with Google and Apple. One-command provider setup from the CLI: moth setup google.
Admin console
An embedded web app for projects, users, API keys, analytics, setup instructions, and login theming. Ships inside the binary.
Flutter & React SDKs
moth_auth and its native companionsmoth_billing and moth_push are served from the binary's own pub repository, @moth/react from its npm registry — the SDK version always matches the server. Nothing hits pub.dev or npmjs.
Admin CLI & agents
The same binary drives any instance: scriptable project and user management, and moth skill export for coding agents.
Server API + JWKS
Your backend verifies tokens offline against the project's JWKS. A token minted for one app can never validate for another.
Subscriptions & entitlements
App Store, Google Play, and Stripe validated server-side — no billing SaaS. Subscription state becomes entitlements like pro, with promos and grace periods; a free tier is always built in. On device, moth_billing runs StoreKit 2 and Play Billing first-party: one dependency, zero adapter code.
Themed paywall, mobile & web
MothPaywallScreen renders your tiers with your branding — copy, layout, and highlighted tier configured per language from the admin. One paywall config drives Flutter and React alike; on the web it sells through Stripe-hosted Checkout, so moth never touches a card.
Push device registry
Every signed-in device registers its APNs, FCM, or Web Push credential — permission state included — via moth_pushor useMothPush(). Your backend reads the live registry and sends with the push services' own APIs; moth registers, your server sends, and dead tokens age out through the feedback loop.
Revenue per month
Store-reported revenue, active subscribers, churn, and trial conversion land on the same analytics tab — per project, per currency, with Apple, Google, and web side by side, in your own database.
Why moth
Honest about where it wins — and where it doesn't.
moth trades managed scale and a long provider list for ownership: your server, your data, one flat bill across an entire portfolio.
| moth | Firebase Auth | Auth0 | Supabase Auth | |
|---|---|---|---|---|
| Where it runs | ||||
| Hosting | Self-hosted, your box | Google-managed | Okta-managed | Managed or self-host |
| Deployment | One static binary | SDK + cloud project | Tenant per environment | Postgres + GoTrue |
| Where user data lives | Your SQLite file | Google's cloud | Auth0's cloud | Your Postgres |
| Portfolio economics | ||||
| Apps per instance | Unlimited projects | One per Firebase project | One per tenant | One per project |
| Pricing model | Flat — you host | Per MAU above free tier | Per MAU, steep tiers | Per MAU above free tier |
| Token signing keys | Per-project ES256 + JWKS | Shared Google keys | Per-tenant keys | Per-project secret |
| Beyond sign-in | ||||
| In-app subscriptions | Built in: receipts → entitlements | Pair with RevenueCat etc. | Not offered | Not offered |
| Web subscriptions (Stripe) | Built in: hosted Checkout | Pair with Stripe yourself | Not offered | Not offered |
| Paywall + revenue analytics | Themed paywall, revenue/mo | Separate products | Not offered | Not offered |
| Push device registry | Built in: registry + feedback; your server sends | FCM (full send pipeline) | Not offered | Not offered |
| What moth doesn't do (v1) | ||||
| Managed scale & SLA | You operate it | Google SLA | Enterprise SLAs | Managed tier |
| MFA / passkeys | Not in v1 | Yes | Yes | Yes |
| Providers | Email, Google, Apple | Many | Many | Many |
Install
Run it your way.
A single static binary for macOS and Linux. Pick a path, then follow theten-minute quick start.
macOS or Linux, via the Homebrew tap (ships with v1.0).
brew install aloisdeniel/tap/moth
moth serve --data-dir ./dataThe install script detects your platform, verifies the release checksums, and installs the binary — MOTH_VERSION andMOTH_INSTALL_DIR override the defaults. Binaries land with the first tagged release (v1.0).
curl -fsSL https://raw.githubusercontent.com/aloisdeniel/moth/main/website/public/install.sh | sh
moth serve --data-dir ./dataThe official image ships with v1.0; until then build your own from the repo. CGO-free, so a distroless base works. Mount /data — it holds the entire state of the instance.
docker run -d -p 8080:8080 -v moth-data:/data \
-e MOTH_BASE_URL=https://auth.example.com \
-e MOTH_MASTER_KEY=… \
ghcr.io/aloisdeniel/mothA hardened unit runs moth as an unprivileged service. Full unit file in thedeployment guide.
[Service]
User=moth
ExecStart=/usr/local/bin/moth serve --config /etc/moth/moth.toml
Restart=on-failure
NoNewPrivileges=true
ProtectSystem=strict
ReadWritePaths=/var/lib/moth