One login, every app
OIDC single sign-on (Authorization Code + PKCE). Sign in once at the hub and every federated app recognizes you — with the role the matrix gives you.
Lockatus
One sign-on for the whole suite.
Lockatus is the identity hub of the Escriba family: a self-hosted single sign-on that every app can delegate to. Until now each tool was single-user; Lockatus gives you multi-user accounts, two-factor authentication (TOTP / Google Authenticator), per-app roles assigned from a visual access matrix, and OIDC single sign-on so logging in once opens every app you’re allowed into.
Federation is optional and non-breaking: each app keeps its own login and opts in behind an
AUTH_MODE=federado flag. Tokens are signed RS256 and verified offline against the hub’s public keys,
so if the hub is down, live sessions keep working. Lockatus is the identity contract of the Escriba
ecosystem.
What it does
Section titled “What it does”The access matrix
A who-by-system grid: each cell is the role a user has in an app. Each app declares its own role catalog; Lockatus assigns them.
Two-factor (TOTP)
Enroll once with Google Authenticator or any compatible app, with one-time recovery codes and an admin reset. Inherited by every app.
Optional, non-breaking
Every app keeps its standalone login. Federation is a flag — turn it on per app, reversible, with no rewrite.
Offline verification
Apps verify the RS256 tokens against the hub’s JWKS without calling home. Revoking access cuts the SSO on the next token refresh.
Onboard new apps
Add any new family app from the matrix itself — declare its slug and roles, no redeploy. Built to grow with the suite.
Part of the Escriba Suite
Section titled “Part of the Escriba Suite”Lockatus is the third contract that keeps the suite in tune — alongside the shared design system and the “Send to Escriba” handoff. Self-hosted and open-source, it lets a team share Escriba, Fisherboy, Anonimal, Fulgoria, Selega, Arcanum and Trustux with one identity and clear, auditable access.