Skip to main content
Flux Pass is the API-only authentication service shared across all Flux applications. It handles user registration, login, sessions, OAuth, service entitlements, payments, and more.
Flux Pass is a public-facing API - unlike the Metadata Service, these endpoints are accessible from the internet. All authenticated endpoints require a valid Bearer token in the Authorization header.

​
Architecture

Flux Pass is built with NestJS and uses the following stack:
ComponentTechnology
FrameworkNestJS
DatabasePostgreSQL via Prisma
Rate limitingArcjet
PaymentsPolar
MonitoringSentry
2FATOTP via Speakeasy
EmailCustom mail service with queue processing

​
Authentication

All authenticated endpoints require a Bearer token: 
Authorization: Bearer <access_token>
Tokens are JWTs containing userId, email, and sessionId. Access tokens are short-lived; use the refresh token flow to obtain new ones.

​
Rate limiting

Flux Pass uses Arcjet for rate limiting on sensitive endpoints:
EndpointWindowMax requests
Login60s30
Register60s10
Email verification60s5
Resend verification60s3
OAuth callbacks60s10
Health check60s50

​
API modules

Authentication

Register, login, logout, email verification, 2FA, and token refresh.

OAuth

Sign in with GitHub, Google, or Microsoft.

User

Avatar management, custom domains, and service entitlements.

Connect

Connect and disconnect from Flux services.

Payments

Polar checkout, customer portal, and subscription management.

Admin

User management and platform statistics (admin-only).

Audit

Activity logs and audit trail.

Health

Service health check endpoint.