Sigil

A minimal OpenID Connect / OAuth 2.0 Authorization Server in Zig. Models itself on node-oidc-provider. Targets OIDC Certification Basic profile.

Built with Zig 0.16.0 + zap (facil.io bindings). Zero JavaScript runtime — single native binary.

Quick Start

# zig 0.16.0 required
zig build
./zig-out/bin/sigil

Server starts on http://127.0.0.1:3000. Default: in-memory storage (data lost on restart).

Docker

docker compose up

Storage Backends

Backend	Env	Description
memory	(default)	In-memory HashMaps, no persistence
file	SIGIL_FILE_DIR=data	Same as memory + JSON Lines to disk
sqlite	SIGIL_SQLITE_PATH=data.sqlite3	Single-file SQL database
postgres	SIGIL_PG_URI=postgresql://...	Full PostgreSQL backend
mysql	SIGIL_MYSQL_URI=mysql://...	MySQL via CLI (requires mysql client)

Select via SIGIL_STORAGE:

SIGIL_STORAGE=sqlite ./zig-out/bin/sigil
SIGIL_STORAGE=postgres SIGIL_PG_URI=postgresql://user:pass@host/db ./zig-out/bin/sigil

Environment Variables

Variable	Default
SIGIL_ISSUER	http://127.0.0.1:3000
SIGIL_HOST	127.0.0.1
SIGIL_PORT	3000
SIGIL_STORAGE	memory
SIGIL_PG_URI	postgresql://excelrx:excelrx_dev@127.0.0.1:5432/sigil
SIGIL_SQLITE_PATH	data.sqlite3
SIGIL_FILE_DIR	data
SIGIL_MYSQL_URI	mysql://excelrx:excelrx_dev@127.0.0.1:3306/sigil

Endpoints

Endpoint	Description
GET /.well-known/openid-configuration	Discovery
GET /jwks	JSON Web Key Set (ES256)
GET /auth	Authorization endpoint
POST /login	Interactive login
POST /consent	User consent
POST /token	Token endpoint (auth_code, refresh_token, client_credentials)
GET /userinfo	UserInfo endpoint
POST /token/introspection	Token introspection
POST /token/revoke	Token revocation

Test

zig build
./zig-out/bin/sigil &
node conform.js

61 conformance checks covering discovery, JWKS, authorization_code (with PKCE), userinfo, refresh_token, client_credentials, introspection, revocation, and error cases.

License

MIT