Clavex - 2026 Pricing, Features, Reviews & Alternatives

Clavex is an open source self hosted identity and access management platform designed to meet native European compliance and advanced authentication requirements. The platform is delivered as a single binary with PostgreSQL and Redis dependencies. The solution caters to enterprises, public agencies, financial institutions, healthcare providers and software vendors that require support for digital identity frameworks such as SPID, CIE and eIDAS two. The platform eschews reliance on external cloud services in favor of a sovereignty focused deployment model.

Clavex EuroID consolidates integration for multiple national digital identity schemes including Italian SPID and citizen identity document, French national federation, Belgian mobile identity and other EU providers with just in time provisioning. The platform implements selective disclosure credential issuance with SDJWT credentials, deep link generation and presentation exchange aligned with eIDAS two architecture frameworks. The authentication stack incorporates JAR, PAR and DPoP mechanisms with Redis backed token replay protection to achieve comprehensive FAPI two compliance. WebAuthn passkey authentication is supported with conditional user interface mediation, device trust attestation catalog integration and per organization policy enforcement. Multi factor authentication capabilities include time based one time codes served as QR images, SMS and email authentication codes and one time backup codes with adaptive lockout governed by real time risk scoring.

Clavex implements a unified authorization engine compatible with OpenID AuthZen standards to deliver real time policy decisions via REST interfaces with fine grained access control and composite role traversal. Continuous risk assessment is provided through threat intelligence signals based on travel anomalies, novel network origins, unusual access patterns and device fingerprinting with adaptive policy actions including step up authentication, denial or audit logging. Identity assurance verified claims are embedded in identity tokens and user information responses according to OpenID Identity Assurance specifications to meet public sector and financial regulations. Security event streams propagate protocol compliant notifications such as session revocation and credential changes to downstream applications using push based token evaluation mechanisms.

The platform also provides privileged access management workflows with just in time approval, encrypted credential vaults, session recording and ephemeral certificate issuance through HashiCorp Vault integration. A visual flow builder enables configuration of authentication sequences with prebuilt steps for attribute validation, external claim enrichment, event hooks and risk based gating. Compliance interfaces expose regulatory obligations as programmatic evidence packages for data protection and operational security directives while audit logs are merkle hashed and cryptographically signed for offline verification. Machine identities for autonomous agents are issued with delegated authorization claims and linked audit trails alongside an OAuth based agent authorization server. Event distribution connectors deliver authentication and policy events to webhooks, message brokers and SIEM endpoints while observability metrics are exposed for integration with time series monitoring systems. The command line scaffolding tool accelerates application integration with pre configured identity workflows for modern web frameworks.