Deployment models — managed SaaS & self-host
Perihelium is delivered two ways, and — this is the important part — both run from one codebase. The tier you're on is a configuration/entitlement value, never a fork, a separate branch, or a different product. What a plan grants in the cloud and what a licence grants on-premise resolve through the same mechanism, so the feature set does not drift between them.
Private beta. The managed service is live and is the delivery path today. Licensed self-host packages the exact stack we run in production — see Self-hosting. Pricing and licences are handled by the Zynth team directly.
The two models
| Managed SaaS | Licensed self-host | |
|---|---|---|
| Who runs it | Zynth (our infrastructure) | You, in your own region/infrastructure |
| Isolation | Pooled — shared infrastructure, isolated at the row level by two independent boundaries | Your instance is inherently single-tenant |
| Best for | Fast start; individuals → SMB → enterprise | Regulated / sovereignty / air-gapped buyers |
| Entitlements from | Your plan (control-plane database) | A signed offline licence bundle |
| Availability | Live (private beta) | By arrangement — enquire |
How the tier actually resolves — the features and caps a plan or licence grants, how usage is metered, and why a limit never interrupts sign-in: Plans, entitlements & usage.
One codebase, no forks. Because the tier is an entitlement and the reference deployment is the distribution artifact, a self-hosted install and a SaaS tenant get the same protocol surface, the same security posture, and the same upgrade path. There is no "community edition" that lags behind — the day a capability ships, it ships for both models (gated by entitlement, not by build).
Tenant isolation (both models)
On managed SaaS, each organization is a tenant with an isolation strategy. Every
organization is pooled — shared infrastructure, isolated at the row level. See
Tenants & users. Pooled isolation is enforced by two
independent boundaries — an always-scoped data layer and Postgres row-level security beneath
it — so a bug in one is not a cross-tenant leak. The buyer-facing detail is in
Security & tenant isolation. A self-hosted install is a
single-tenant deployment by nature, but runs the identical isolation machinery.
Integration: standards-based, with an SDK on top
Perihelium is a standards OpenID Provider (OAuth 2.1 + OIDC Core) — point any OIDC library at the issuer URL and it works, no bespoke code:
- Discovery:
GET https://<your-issuer>/.well-known/openid-configuration /authorize(authorization code, PKCE S256 required),/token(authorization_code·refresh_tokenwith rotation + reuse detection ·client_credentials),/userinfo, and RP-initiated + back-channel logout (end_session_endpoint).id_tokensigned RS256, verifiable offline against the same JWKS; the issuer is your own domain on a self-hosted install.- Register apps under Organization → OAuth Clients (confidential or public, show-once secrets, exact-match redirect URIs); users manage grants under Account → Connected apps.
Full walkthrough — register a client, run authorization-code + PKCE, verify the id_token, wire up logout: Log in with Zynth Auth (OIDC).
The SDK does not go away — it stays the value-add layer (embedded rate limiting, sanitization, CSRF, anomaly reporting, agent ergonomics) on top of the standard floor, the same pairing you see from Auth0 and Clerk. Prefer plain REST + JWKS verification? See Verifying tokens; prefer the batteries-included path? See the TypeScript SDK.
Bounded profile. Implicit and ROPC grants are never implemented; CIBA, dynamic client registration, PAR, and JAR/JARM are out of scope for this profile. For a CLI login see Signing in from a CLI (any-port loopback and the device grant). Zynth supports OIDC; it is not an OpenID-certified implementation.
Interested in self-host? The self-hosted page takes licence enquiries — early enquiries shape what the distribution packages.
What a self-host customer can count on
- Feature parity with SaaS — same codebase, tier as entitlement.
- A clear upgrade path — semantic versioning with an enforced meaning: patches carry security/bug fixes only (no schema migrations, no new required config) and are safe to self-apply unattended, with automatic rollback; minor/major upgrades run a gated runbook.
- The same signed supply chain we use — release images are cosign-signed and verified before they run; an offline bundle supports air-gapped installs.
- Offline by design — licence verification is fully offline (no phone-home), and an expired or missing licence never blocks authentication — it degrades premium features, never core IAM. Your identity layer cannot be bricked by a licensing edge case.
Next
- Self-hosting overview — the deployment shape self-host packages.
- Security & tenant isolation — the trust story for buyers.
- Tenants & users — the identity model both models share.