Building a Rust-Based Auth Server: Achieving OAuth2 Compliance in Under 20MB of RAM

Your auth server shouldn’t cost more RAM than your entire app. So I wrote my own in Rust.

Developer Luis engineered OVTL, a lightweight authentication server designed specifically for resource-constrained environments like $6/month VPS droplets. The system delivers a full OAuth2 and OIDC stack while maintaining an idle memory footprint of less than 20MB.

Why This Matters

Mainstream identity providers like Keycloak or Authentik require between 512MB and 735MB of RAM, often exceeding the total resource budget of small-scale freelance or side projects. This overhead forces developers into costly SaaS subscriptions or oversized infrastructure, whereas a memory-efficient Rust implementation allows for co-hosting authentication and application logic on the same entry-level server without performance degradation.

Key Insights

• Memory overhead comparison: Keycloak idles at ~512MB RAM and Authentik at ~735MB, whereas OVTL remains under 20MB using Rust’s zero-GC runtime (2026).
• Zero-knowledge encryption: User data is protected at rest using AES-256-GCM via a custom double-envelope key model implemented in the ‘hefesto’ Rust crate.
• Database-level isolation: Multi-tenancy is enforced through PostgreSQL Row Level Security (RLS) to ensure tenant data remains isolated even if application-layer bugs occur.
• Mandatory Security Standards: OVTL enforces PKCE on every Authorization Code flow to prevent token interception, rather than leaving it as an optional configuration.

Working Examples

Command to launch the OVTL Terminal User Interface (TUI) for managing tenants, users, and roles through a wizard setup.

$ ovlt --url http://localhost:3000

Practical Applications

• Use Case: Deploying secure OIDC stacks on 1GB RAM droplets for small-scale freelance projects. Pitfall: Attempting to run Java-based auth servers like Keycloak on low-tier instances frequently results in OOM (Out of Memory) kills.
• Use Case: Implementing multi-tenant SaaS platforms requiring database-enforced isolation via PostgreSQL RLS. Pitfall: Relying on application-layer multi-tenancy which can lead to data bleeding during code regressions.

References:

• https://dev.to/shrpp/your-auth-server-shouldnt-cost-more-ram-than-your-entire-app-so-i-wrote-my-own-in-rust-1o83