Shared login is useful, but shared authority is dangerous. I built TotalAuth around a simple separation: the identity provider establishes who or what is calling, while each application keeps ownership of its data and resource-level decisions. A calendar, a game, and an operations tool can share sign-in without sharing sessions, databases, or a universal permission model.

TotalAuth automates several distinct identity lifecycles rather than forcing every caller through one generic client. Browser applications receive public OIDC clients with exact HTTPS origins and PKCE. Machine workloads receive their own scoped principals. API resources can receive an audience and roles without receiving any credential at all. Human onboarding follows a separate, bounded approval path.

Repositories opt in through committed manifests, and protected gateways bind those declarations to reviewed platform delivery mappings. The resulting handoffs expose the non-secret contract an application needs—issuer, audience, role claim, scopes, and identity references—while encrypted runtime material travels only to the mapped consumer.

The same philosophy extends to collaboration. Automated Forgejo access uses a short-lived assertion exchange rather than a long-lived personal access token, and workstation requests pass through a constrained adapter and an operation allow-list. TotalAuth turns identity onboarding from an assortment of privileged manual steps into a reviewable system with explicit edges.