---
title: "Frank"
tagline: "Auth server"
language: "TypeScript"
license: "MIT"
since: "2025"
canonical: "https://xraph.com/work/frank"
---

# Frank

A standalone multi-tenant auth server with a three-tier user model: platform staff, the customer organizations they serve, and those organizations’ own end users. Written before Authsome, and largely the reason Authsome exists as a library instead of a service.

## Install

```bash
pnpm add @xraph/frank
```

## What it is

Frank is a standalone multi-tenant authentication server, embeddable in a Go backend or hosted on its own, with a Clerk-compatible API surface as the target.

## Three tiers of user

The model that makes it different from most auth servers, and the part that survived into Authsome:

1. **Internal users**: your own staff, running the platform. Full administrative access.
2. **External users**: the developers and admins at a customer organization, managing their own authentication configuration.
3. **End users**: the customer's own users, who never see any of the above.

Most auth systems model two of these and fake the third, which produces an admin panel where your staff and your customers' staff share a permission model that fits neither.

## Why Authsome exists anyway

Frank works, and running it taught me that most teams do not want a second service to operate for authentication. They want it inside the process they already deploy, with their own database and their own migrations. Authsome is that, with the method-as-plugin structure Frank did not have.

---

*Unpublished draft. Not peer reviewed and not submitted to a venue.*


## Anatomy

- **Internal users**: Staff, with their own policy surface.
- **External users**: Customer organisations and their members.
- **End users**: The customer’s own users, isolated per tenant.

## Constraints and trade-offs

- (decision) Three tiers of user, separated at the model. Collapsing them is what makes B2B auth go wrong.
- (trade-off) A server, not a library. Authsome exists because not every product wants another deployment.