One library, every framework.

Magic links, email one-time codes (sign-in, email verification, password reset), phone codes for a verified second contact, one-time tokens that hand a session to another device; each ends in core's login envelope behind core's MFA gate.

Usernames unique without regard to case, and sign-in with a username or the email through core's password path.

Guest sessions, their conversion into the account the guest signs up for through a host hook, and the pruning of unconverted guests.

Several signed-in accounts on one device, switching between them without signing in again, signing one out, the device's last sign-in method.

OAuth 2.0 / OpenID Connect sign-in through Google, Apple, Microsoft, GitHub and fifteen more providers or any OAuth 2 server, account linking under a policy, Google One Tap, provider tokens on the user's behalf, an OAuth proxy for preview origins.

WebAuthn passkeys, registration and discoverable sign-in with conditional UI, each passkey also a core MFA factor verified through core's own MFA routes.

API keys owned by users and organizations with a subset of the owner's permissions, their own rate limit, expiry, rotation with a grace window and revocation; a key authenticates every Polaris route as its owner.

Polaris as an OAuth 2.1 / OpenID Connect provider; authorization code with PKCE, refresh rotation, client credentials, the device flow, CIBA, token exchange, DPoP, dynamic registration, client ID metadata documents, discovery; scopes are permissions.

Polaris and the Model Context Protocol. McpProtectedResource protects any PHP MCP server with Polaris-issued tokens (RFC 9728 metadata, insufficient_scope step-up, DPoP, local keys or a remote issuer); Polaris itself is an MCP server whose tools are its routes and CLI commands, listed per principal, over POST /mcp and bin/polaris mcp.

AI agents as principals. Registration and host enrolment, delegated (token exchange with act) and autonomous (client credentials, private_key_jwt) agents, signed request JWTs, capability grants with constraints and budgets, approvals by device code, CIBA or in-app, signed receipt chains, a kill switch; Agent Auth Protocol compatible discovery.

Per-organization SAML 2.0 and OpenID Connect providers, verified domains, just-in-time users and memberships, single logout in both directions, the organization's own self-service routes.

A SCIM 2.0 server per organization; a directory provisions members and roles with a connection token the organization creates and rotates itself.

The operator API over users, sessions, MFA, organizations, audit drains and statistics, for admin users and API keys, every action audited.

Every Polaris event becomes a catalogued, redacted, append-only record, queried per user and per organization, streamed to sinks and to each organization's drains, pruned by policy, optionally hash-chained.

The verification, reset, invitation, one-time-code and security messages from templates overridable per instance and per organization, translated, rate-limited, sent through the channel you choose (Symfony Mailer, PHPMailer, Twilio, Vonage, a log).

A local risk engine on sign-up, sign-in, password reset and code sends; signals score an attempt, a policy allows, challenges or blocks, observe mode records without enforcing.