Ecosystem
Overview
The OpenApe package ecosystem.
Ecosystem
OpenApe isn't a monolith — it's a set of small, focused packages you compose as needed. Use one. Use all. Each works standalone.
Architecture
┌─────────────────────────────────────────────┐
│ Framework Modules │
│ nuxt-auth-idp nuxt-auth-sp nuxt-grants │
├─────────────────────────────────────────────┤
│ Protocol Packages │
│ @openape/auth @openape/grants │
├─────────────────────────────────────────────┤
│ Foundation │
│ @openape/core │
└─────────────────────────────────────────────┘
Packages
| Package | Description | Framework |
|---|---|---|
@openape/core | DNS discovery, crypto, PKCE, JWT utilities | None |
@openape/auth | OIDC login protocol — IdP and SP sides | None |
@openape/grants | Grant lifecycle, AuthZ-JWT issuance | None |
@openape/nuxt-auth-idp | Drop-in Nuxt module: run your own IdP | Nuxt |
@openape/nuxt-auth-sp | Drop-in Nuxt module: login via OpenApe | Nuxt |
@openape/nuxt-grants | Drop-in Nuxt module: grant management | Nuxt |
openape-sudo (apes) | Rust binary for privilege elevation | OS-level |
Combinations
| Use Case | Packages |
|---|---|
| App with OpenApe login | nuxt-auth-sp |
| Run your own IdP | nuxt-auth-idp |
| Agent permissions | nuxt-grants |
| Full IdP + Grants | nuxt-auth-idp + nuxt-grants |
| SP with grant requests | nuxt-auth-sp + nuxt-grants |
| Non-Nuxt integration | @openape/auth + @openape/grants |
| Local privilege elevation | openape-sudo (apes) |
Design Principles
- Separation — Auth ≠ Grants. Not every app needs both.
- Layered — Core → Protocol packages → Framework modules → Apps
- Stateless SP — Service providers need zero server storage.
- Framework-agnostic core — Nuxt modules are convenience, not requirement.
- Passkeys-only — No passwords. NIS2 compliant by design.
- Minimal tokens — AuthN says who, AuthZ says what may they do.