Architecture
Who holds which credential, what is on the login path, and what each public hostname serves.
RealmSSO runs the API server, the sign-in service and the dashboard for you. You install and operate nothing.
The API server is not on the login path
Your application speaks standard OIDC to the sign-in service. The sign-in service exchanges the authorization code. The API server does not sit on your application's login path. It does not proxy the code exchange.
Your login page can ask the API which connection fits an email domain. That call happens before sign-in starts. After that, the sign-in goes to the sign-in service, not to the API.
For an OIDC connection, the sign-in service also keeps the tokens that your customer's identity provider issues.
Who holds which credential
| Part | What it holds |
|---|---|
| API server | The database credentials, and the credentials it uses to manage realms in the sign-in service. It reads the encryption key ring from the platform’s secret store. |
| Sign-in service | The secrets of the clients in each realm. |
| Dashboard | No credential on the server side. It is static files. It sends the dashboard user’s session token with each call to the API server. |
| This marketing site | Nothing. It is a static site with no credentials and no session. |
A realm is a separate sign-in space that RealmSSO creates for each account. See Accounts and isolation for what a realm separates and what stays shared.
What each public hostname serves
| Hostname | What it serves | Who reaches it |
|---|---|---|
api.realmsso.com | The RealmSSO API. SCIM requests from your customers’ identity providers also arrive here. | Your application and your customers’ identity providers |
app.realmsso.com | The dashboard, at /dashboard, and the Admin Portal. Their calls to the API go through this hostname to the API server. | Dashboard users and your customers’ IT admins |
sso.realmsso.com | The sign-in service. | Your application and your customers’ users |
All three hostnames resolve and answer. We checked on 2026-10-03.
Building now. The edge would bind each per-customer hostname to its realm. Per-customer hostnames are built and switched off in production.
What fails when the sign-in service is down
- A restart or an upgrade of the sign-in service interrupts sign-in while it starts.
- One sign-in service instance and one API server instance run today. No standby exists.
- Dashboard sign-in does not depend on the sign-in service. Dashboard users can still sign in while the sign-in service is down.
Where to go next
How we run your instance — hosting, backups and monitoring.
Security overview — what keeps customers apart, and what we do not claim.