Duende Software builds standards-compliant, extensible identity and access SDKs for .NET, led by IdentityServer for OpenID Connect and OAuth 2 in ASP.NET Core.

Provides a secure backend service for browser-based applications, handling authentication, session management, and API access while protecting against common security threats such as token extraction and CSRF attacks. It enables organizations to centralize identity and security logic, support multiple frontends, and manage user sessions across distributed systems.

Browser-based frontends often face security risks when directly handling authentication and tokens. Implementing a Backend For Frontend (BFF) pattern with ASP.NET Core, this solution provides a secure intermediary that manages all identity, OAuth/OIDC protocol interactions, and session state on the server, minimizing exposure to token extraction and CSRF attacks.

Organizations seeking to securely manage authentication and API access for distributed applications can use this solution to implement OpenID Connect and OAuth 2.x authorization servers in ASP.NET Core environments. The Business Edition extends core protocol support with advanced features such as server-side session management and automatic signing key rotation, supporting more complex security and operational requirements for growing businesses.

Enterprise delivers unlimited client IDs, unlimited deployments, and 2 priority escalations/year—perfect for .NET identity teams.

Starter delivers OAuth 2.0/OpenID Connect server, 5 client IDs ($9,000/yr), and $500/client ID/yr beyond—perfect for .NET developers and small teams.

Business delivers 15 client IDs, unlimited users, and unlimited APIs—perfect for .NET development teams.

Organizations managing sensitive applications and APIs can enforce comprehensive identity and access management by deploying a standards-compliant OAuth 2.0 and OpenID Connect authorization server with extensive customization options. The Enterprise Edition offers unlimited support for OAuth client IDs, logical deployments, developer support, advanced auditing, dynamic provider configuration, and multi-tenancy, enabling scalable integration and administration for complex business environments.

Provides core OAuth 2.0 and OpenID Connect protocol implementation for ASP.NET Core applications, enabling organizations with basic authentication and authorization needs to implement standards-compliant identity infrastructure. It includes support for up to 5 client IDs in self-hosted deployments, unlimited users and APIs, a single deployment environment, security notification services, standard developer support, and access to source code.

Unlimited Business delivers unlimited users, unlimited APIs, and unlimited client IDs—perfect for ISVs and SaaS vendors.

Unlimited Enterprise delivers unlimited users, unlimited APIs, and 6 support escalations/year—perfect for OEMs and ISVs.

Provides a full-featured OAuth 2.0 and OpenID Connect server implementation for ASP.NET Core, supporting unlimited client IDs, users, and APIs within a single deployment. Includes automatic key management, server-side sessions, standard developer support, and access to source code, enabling organizations to manage authentication and authorization at scale without client limitations.