Torii · identity for kishi

One identity gate for every Many Ninja service.

Torii holds every OAuth app, every session, every password hash. Sites hold nothing but their own slug and Torii's origin. Adding Discord to every service in the platform is a toggle — not a deploy.

No per-site OAuth apps or client secrets
One shared session cookie across every kishi domain
Provider toggles surface instantly — no code changes
Backends read identity from trusted headers, not JWTs

How it works ↓ · The full spec ↗

Sign in to Many Ninja

Continue with Torii, or use a password below.

New to Many Ninja? Create an account

How Torii works

One button, one gate, every service.

The three moving parts you need to understand.

Password auth

The site posts credentials to Torii. Torii verifies the Argon2 hash and sets a signed gate_jwt cookie scoped to the platform's apex domain.

→ POST /api/v1/auth/login ← Set-Cookie: gate_jwt

SSO handshake

Clicking the Torii button opens a popup on the Torii origin. Torii runs the OAuth flow with Google, Discord, or any provider — the site never sees the third party.

→ window.open(torii) ↔ provider dance ← postMessage back

Forward-auth

Traefik consults Torii on every request to a protected route. Backends receive X-User-Id, groups, and permissions as trusted headers — no JWT parsing, no rewriting login per service.

→ request ↔ traefik → torii ← X-User-Id, X-Groups