Universal Bitcoin Identity Layer

A production-focused Flask service that bridges OAuth2/OpenID Connect with Lightning Network authentication. The project couples hardened security defaults, Redis-backed rate limiting, RS256 JWT issuance, and Postgres persistence so Bitcoin-enabled applications can expose standards-compliant identity endpoints.

🚀 Highlights

• Security-first OAuth2/OIDC core – RS256 tokens with on-disk JWKS rotation, PKCE validation, HTTPS enforcement through app.security, and Redis-powered rate limiting with production fail-closed behavior and explicit non-production in-memory fallback warnings.
• Lightning-aware identity workflows – LNURL-auth challenge storage, Bitcoin signature verification helpers, and adapters that keep the legacy authorization views working while the storage layer matured.
• Persistent storage – SQLAlchemy models for OAuth clients/codes/tokens, sessions, LNURL challenges, proof-of-funds requests, and audit logs backed by Postgres with Redis coordination for ephemeral state.
• Operational tooling – /metrics/prometheus endpoint, structured JSON logging, and a reusable create_app() factory (app/factory.py) for factory-based deployments.
• Typed configuration surface – Environment-driven configuration validated by app.config, including production guardrails for secrets, Redis, and database connectivity.

🏗️ Architecture at a Glance

Further documentation lives in the app/ directory and supporting deployment guides under deployment/.

🧰 Prerequisites

• Python 3.10+
• Postgres 13+
• Redis 6+
• Bitcoin Core 24+ (for RPC-backed features)

For local development you can omit Postgres/Redis by exporting DATABASE_URL and REDIS_URL pointing to ephemeral services (e.g. docker-compose) or by relying on the in-memory storage adapter for tests.

🏁 Quick Start

python3 -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt
export 

... [View full README on GitHub](https://github.com/hodlxxi/universal-bitcoin-identity-layer#readme)