Repolode
Submit
dromara

dromara/Sa-Token

A Java authentication and authorization framework covering login, permissions, SSO, OAuth2, JWT and API signing for Spring and other web stacks.

Open-source alternative to:Spring SecurityApache Shiro

View on GitHubWebsite
Stars
19,111
Forks
2,911
Open issues
123
Last commit
22 days ago

What is it?

Sa-Token is a Java framework for handling authentication and authorization in web applications. It provides login sessions, role and permission checks, forced logout, and session management, with annotation-based or route-based enforcement. The core API is a short static call such as StpUtil.login(userId) followed by StpUtil.checkLogin().

Beyond basic login, the project bundles single sign-on in three deployment modes (same domain, cross domain, and cross Redis), an OAuth2 server supporting the authorization code, implicit, password and client credentials grants, and microservice gateway checks for Gateway, ShenYu and Zuul. It also includes JWT integration, API Key authorization, API parameter signing, Http Basic and Digest authentication, and account banning.

Integration packages cover Spring Boot 2 and 3/4, Spring WebFlux, Solon and JFinal, with Redis available as a persistence layer. Official demos and documentation are provided in Chinese.

Key features

  • 01Login sessions with multi-device, single-device and mutually exclusive login modes
  • 02Annotation and route-based permission and role checks
  • 03Single sign-on in three modes, plus single logout
  • 04OAuth2 server supporting four standard grant types
  • 05JWT integration and API Key authorization
  • 06API parameter signing to prevent tampering and replay

Use cases

  • Adding login and role-based access control to a Spring Boot backend
  • Building single sign-on across several internal web systems
  • Protecting APIs at a microservice gateway
  • Issuing OAuth2 tokens from your own Java service

Quick start

  1. 1

    Add the Spring Boot starter dependency to pom.xml

  2. 2

    Log a user in with one static call

    StpUtil.login(10001);
  3. 3

    Protect an endpoint so only logged-in clients can access it

    StpUtil.checkLogin();

Things to know

  • The README is written mainly in Chinese, with full documentation hosted at sa-token.com.
  • Java-only; other languages are covered by separate community ports with their own maintenance status.

In collections

Microservice frameworks & service infrastructureLogin, SSO & identity servers

Topics

#authentication#authorization#java#spring-boot#sso#oauth2#jwt#microservices#aouth2#springcloud

FAQ

What is Sa-Token?
A Java authentication and authorization framework covering login, permissions, SSO, OAuth2, JWT and API signing for Spring and other web stacks. Sa-Token is a Java framework for handling authentication and authorization in web applications. It provides login sessions, role and permission checks, forced logout, and session management, with annotation-based or route-based enforcement. The core API is a short static call such as StpUtil.login(userId) followed by StpUtil.checkLogin().
Is Sa-Token free to use? What license does it have?
Sa-Token is open source under the Apache-2.0 license. Check the license terms before using it in commercial products.
Is Sa-Token still maintained?
Actively maintained. The last commit to Sa-Token was on Oct 16, 2026.
What can I use Sa-Token for?
Adding login and role-based access control to a Spring Boot backend Building single sign-on across several internal web systems Protecting APIs at a microservice gateway Issuing OAuth2 tokens from your own Java service
How do I install Sa-Token?
Add the Spring Boot starter dependency to pom.xml Log a user in with one static call: StpUtil.login(10001); Protect an endpoint so only logged-in clients can access it: StpUtil.checkLogin();
Where can I get Sa-Token?
The source code and installation instructions are on GitHub: https://github.com/dromara/Sa-Token

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects