MacKey

MacKey is the single sign-on identity hub for MacCare. One account, one login, and every app across the company's subdomains knows who you are. Built with Fastify, TypeScript, React, and MongoDB, it acts as a full OAuth 2.0 / OIDC authorization server that other apps plug into with a standard redirect flow.

Sign in once at the hub and a session cookie scoped to the whole domain rides along to every subdomain app. Any app can ask "who is this?" and get back a verified identity, so there's no separate password for billing, scheduling, or any internal tool. Log out once and you're out everywhere.

Apps integrate the standard way: a top-level redirect to the hub, an authorization code back, and a back-channel exchange for a short-lived, audience-scoped id_token that the app verifies against the hub's JWKS. It serves the OIDC discovery document, so drop-in libraries like openid-client, NextAuth, or oidc-client-ts work with nothing but an issuer URL and a client ID. Confidential apps use a client secret; pure SPAs use PKCE.

Employees and admins can log in through Microsoft or Google, while external users keep a password. The hub sits downstream as its own OAuth server, so federation is a config change, not a rebuild, and every app behind the hub inherits it automatically.

Admins manage the whole workforce from one dashboard: create employees, set roles and departments, bulk-import from a spreadsheet, and deactivate accounts. Disabling someone is instant and central, they immediately stop getting tokens anywhere. There's a bulk credential regeneration flow with emailed one-time passwords for onboarding.

Every integration is registered as a single Application with independent toggles for Auth (sign-in) and Data (a read API plus directory-sync webhooks), sharing one client secret. Apps can be Open, where any signed-in principal may enter, or Restricted, where only people an admin explicitly grants may enter, and switching between them is one click. Registered apps also get a shared email service: instead of each app wiring up its own SMTP, they relay mail through the hub, which runs it on MacCare's real Workspace email pipeline via an async, durable delivery queue with on-disk attachment staging.

Apps that mirror the employee directory subscribe to durable, per-app FIFO webhooks that push every employee and department change as it happens, plus a can-delete veto so a downstream app can block removal of someone it still depends on. All hook calls are signed and verified against the same JWKS.