Getting Started
Introduction
What OutlabsAuth is, and what it is not.
OutlabsAuth is a library, not a hosted login service.
You install it into your FastAPI app, point it at your PostgreSQL database, mount the routers you need, and keep authentication and authorization inside your product — without standing up a separate IdP you do not control.
What you get
Two presets
SimpleRBAC for flat roles, EnterpriseRBAC when you need an org tree.
Sign-in surface
JWTs, API keys, invitations, optional OAuth, magic links, and phone access codes.
Permissions that scale
RBAC first, optional ABAC, entity hierarchy, and tree permissions.
What it is not
OutlabsAuth is not a multi-tenant SaaS IdP you sign up for, and not a
black-box auth microservice you must deploy separately (unless you choose to
wrap the library that way). Your product still owns customer-facing screens.
Mental model
your-app
Your FastAPI app
├── OutlabsAuth (library)
│ ├── Postgres tables (users, roles, …) in your DB / schema
│ ├── Router factories you choose to mount (/auth, /users, …)
│ └── deps you use on host routes (authenticated, require_permission, …)
└── Optional: OutlabsAuth UI → talks to your mounted API
You decide the URL prefix (/auth, /v1, /iam, …). The admin UI’s
authApiPrefix must match that choice.
Two presets
| If you need… | Use |
|---|---|
| Users with global roles (blog, SaaS without org tree) | SimpleRBAC |
| Hierarchy, “permissions in this team / office”, tree access | EnterpriseRBAC |
Short chooser: Choosing a Preset. Concepts:
Core Authorization Concepts.
Next step
Continue with Getting Started — install, migrate, mount, and log in.