# HelixIAM

**HelixIAM** is the complete identity & access management platform for modern applications — a
multi-tenant OpenID Connect and SAML 2.0 identity provider with strong authentication, federation,
EU electronic IDs, provisioning, and a full admin & end-user console. It secures **human, machine, and
AI-agent** identities alike: first-class non-human identities (NHI) with an accountable owner, a
lifecycle kill-switch, and on-behalf-of delegation for agents acting for users. Secure every app with
enterprise single sign-on, run it on your own infrastructure, and own your identity layer end to end.

<div class="grid cards" markdown>

-   :material-rocket-launch: **Get started**

    Try it in one command, then install for real with Docker Compose or Helm.

    [:octicons-arrow-right-24: Getting started](getting-started/index.md)

-   :material-cog: **Manage**

    Realms, applications, users, roles, scopes & claims, groups, organizations.

    [:octicons-arrow-right-24: Manage](manage/index.md)

-   :material-shield-key: **Authenticate**

    The flow editor, MFA, passkeys, device push, and risk-based step-up.

    [:octicons-arrow-right-24: Authentication](authentication/index.md)

-   :material-account-network: **Federate**

    OIDC / SAML / LDAP / social brokers, DigiD, eHerkenning and eIDAS, and the EU Digital Identity Wallet (Beta; Digital Credentials API, verify-only and the decentralised-identity features are Preview).

    [:octicons-arrow-right-24: Federation & eIDs](federation/index.md)

-   :material-puzzle: **Integrate**

    SDKs, Terraform, SCIM, webhooks, the API reference and the account console.

    [:octicons-arrow-right-24: Integration](integration/index.md)

-   :material-server: **Operate**

    Keys, theming, RBAC, GDPR, observability, backup/DR and hardening.

    [:octicons-arrow-right-24: Operations](operations/index.md)

</div>

## What Helix does

| Capability | |
|------------|--|
| **Protocols** | OAuth 2.1 / OpenID Connect (authorization code + PKCE, client credentials, refresh, device, CIBA), SAML 2.0 IdP, FAPI (mTLS-bound tokens, signed request objects, JARM), DPoP, PAR |
| **Authentication** | Data-driven flow engine; password policy + breach check + lockout; TOTP, SMS/email OTP; WebAuthn passkeys; device push with number matching; transaction signing (WYSIWYS) |
| **Federation** | OIDC, SAML, LDAP/AD and social brokers with JIT provisioning, account linking, and [mappers](federation/mappers.md) in both directions: upstream claims and attributes to user attributes and roles, and user attributes and roles to SAML attributes |
| **EU eIDs** | DigiD (NL citizen), eHerkenning (NL business), eIDAS (EU cross-border) connectors; sign-in with an EU Digital Identity Wallet through an OpenID4VP verifier (**Beta**; Digital Credentials API and verify-only are **Preview**), with issuer trust from [signed EU trusted lists](federation/trusted-lists.md); the [BSN](federation/digid.md#how-the-bsn-is-handled) stored encrypted per realm, masked in the console and released only to applications a realm-admin opts in |
| **Decentralised identity** (*Preview*, not yet tested with a real national wallet) | [Wallet step-up](federation/wallet-step-up-and-profile.md) without signing in again, with a lifetime, attribute matching and verified attributes kept on the profile; [Credentials beyond the PID](federation/wallet-credentials.md) (driving licence, diploma, qualification) with per-credential trust and claims-to-roles mappers; [credential issuance](federation/credential-issuance.md) over OpenID4VCI (SD-JWT VC and mdoc, status-list revocation); [verified data for applications](integration/verified-claims.md) as OIDC `verified_claims`; a [verification API](integration/verification-api.md) to prove attributes without a sign-in; [transaction confirmation](federation/wallet-transaction-confirmation.md) with the wallet; [DIDs](federation/dids.md) (`did:jwk`, `did:key`, `did:web`) for ecosystems outside the EUDI framework |
| **AI agents / NHI** | First-class agent identities with an accountable owner, lifecycle kill-switch, `nhi` token claims, least-privilege roles, and RFC 8693 on-behalf-of delegation (effective roles = user ∩ agent leash ∩ scope) |
| **Workload identity** | Keyless token exchange for Kubernetes/CI workloads (federated JWTs, no stored secret) |
| **Multi-tenant** | Realms isolate users, agents, clients, keys, flows and branding; each realm is its own OIDC issuer **and** SAML 2.0 IdP |
| **Provisioning** | SCIM 2.0 (in and out), LDAP sync, bulk import, Dynamic Client Registration |
| **Authorization** | Realm & client roles, hierarchical groups, UMA 2.0 authorization services (resources / policies / permissions), and resource indicators (RFC 8707) |
| **B2B** | Organizations — member companies with their own domains and identity providers inside a realm |
| **Operations** | Per-realm key management & rotation (bring your own key and certificate, ES256, CSR, staged activation), audit log + SIEM, outbound webhooks, admin RBAC, GDPR tools, data retention, database TLS, Prometheus metrics & health, [high availability](operations/high-availability.md) without Redis |
| **Consoles** | A React admin console and a self-service end-user account console |

## How it's built

Helix ships as two independent images that scale separately:

- **helix-iam-server** — OAuth2 / OIDC / SAML endpoints, the sign-in pages, the admin REST API, the identity domain and the end-user account console (`/realms/{realm}/account`), owning one PostgreSQL database directly. No message broker. It runs as **n replicas, stateless across replicas**: sessions, tokens, flow state and rate limits live in PostgreSQL (or, optionally, Redis), so any replica answers any request.
- **Admin console** (`helix-dashboard`) — the operator UI, an nginx image with its own Helm Deployment, replica count, HPA and ingress. It proxies the admin API to the server, holds no state, and can run internal-only on its own "beheer" host.

See [Architecture](getting-started/architecture.md).

## Licence

HelixIAM is **commercial, proprietary software** from KubeDNA B.V. For a licence, a demo or pricing, contact
KubeDNA B.V. at [contact@helixiam.com](mailto:contact@helixiam.com). See [Licensing](licensing.md).

!!! tip "New here?"
    Start with the [Quickstart](getting-started/quickstart.md) to get a working instance in one
    command, then read [Core concepts](getting-started/concepts.md) to learn the vocabulary
    (realms, applications, clients, flows) the rest of the docs use.