Authlete is a headless OAuth 2.0 and OpenID Connect engine from Authlete, Inc., founded in 2015. Developers building their own authorization server forward each authorization and token request to the Authlete API, which processes it and returns the next step. The customer keeps its own login and consent screens and its user accounts.

It suits customer identity and access management (CIAM) and public APIs, and has no employee SSO portal, directory sync or user provisioning. Authlete stores tokens and handles issuance, validation, refresh and revocation.

Grant types include device code, token exchange and JWT bearer, and clients may authenticate with private_key_jwt or mutual TLS. It also supports Proof Key for Code Exchange (PKCE), Demonstrating Proof of Possession (DPoP), Dynamic Client Registration and OpenID for Verifiable Credential Issuance (OID4VCI).

Financial-grade API (FAPI) is a stricter OAuth security profile for banking and payment APIs. Authlete is OpenID certified for FAPI 1.0 Advanced, FAPI 2.0 and Client Initiated Backchannel Authentication (CIBA), including the UK, Australian and Brazilian open banking profiles. FAPI is an option on every plan.

Authlete runs on Google Cloud as a shared or dedicated managed service, in regions in Japan, the United States, Brazil and the EU. The Enterprise plan can also be self-managed, including on AWS or Azure. SDKs cover Java, TypeScript and Ruby, and a free trial is available.

Product and pricing pages, the spec sheet and developer documentation are in English.