Building in public

The missing middleware layer for enterprise identity.

ContextIO unifies identity resolution, authorization, consent, and audit into a single SSO-agnostic middleware. Stop stitching. Start shipping.

Get early access → See the architecture

middleware.ts

            import { ContextIO } from '@contextio/sdk';

            // One middleware. Every identity provider. Full audit trail.

            const ctx = ContextIO.create({

              adapters: ['okta', 'azure-ad', 'auth0'],

              authorization: { model: 'rbac+abac' },

              consent: { enforce: true },

              audit: { replayable: true, soc2: true }

            });

            app.use(ctx.middleware());

The Problem

Your identity stack is a patchwork. It shouldn't be.

Enterprise teams run Okta + Azure AD + custom auth simultaneously. Authorization logic is scattered across services. Consent is an afterthought. Audit is a nightmare.

🔒

Authorization is scattered

RBAC checks live in 47 different microservices. One missed check = one breach. Cerbos or OPA solve authorization, but not identity resolution or consent.

🔌

Identity is fragmented

Three SSO providers. Five internal services. Zero unified context. WorkOS handles auth, but who normalizes the identity layer across all of them?

📋

Compliance is bolted on

SOC 2 auditors ask for access logs you can't produce. Consent records are spread across databases. Your audit trail has gaps you hope nobody finds.

The Architecture

Five layers. One middleware.

ContextIO sits between your identity providers and your application. Every request flows through a unified context layer.

Identity Resolution

Normalize tokens from any SSO provider into a single, enriched identity context. Okta, Azure AD, Auth0, custom OIDC. One interface.

Authorization Engine

RBAC + ABAC policies evaluated at the middleware layer. Declarative, testable, version-controlled. No more scattered permission checks.

Consent Management

Enforce data privacy consent at the request level. GDPR, CCPA, HIPAA compliant by default. Consent state travels with every request context.

Context Normalization

Tenant-aware, adapter-driven context enrichment. Commerce, CRM, inventory, WMS namespaces. Your app sees one clean context object.

Replayable Audit Log

Every decision. Every access. Every consent change. Event-driven pub/sub with full replay capability. SOC 2 ready from day one.

Capabilities

Built for platform teams.

Identity

SSO-Agnostic

Adapter/plugin architecture supports any OAuth2/OIDC provider. Swap providers without touching application code.

Authorization

Policy as Code

Define RBAC and ABAC rules declaratively. Test them in CI. Deploy through your existing pipeline. No more inline permission checks.

Identity

Multi-Tenant Isolation

First-class tenant boundaries. Data never leaks between tenants. Built for B2B SaaS from the ground up.

Privacy by Design

Consent enforcement at the middleware layer. Users control their data. Compliance is automatic, not manual.

Audit

Full Event Replay

Pub/sub event log with complete replay capability. Debug authorization decisions. Satisfy auditors instantly.