Open source · Cardano SPO tooling

Your stakers are already your members.

Ouro Pass turns active delegation into membership. Staking identity becomes an OAuth login, and your delegators become a community you can reach directly — on infrastructure you run, not a platform you rent.

Get started View on GitHub
One Go binary OAuth 2.0 + PKCE Zero key custody
CIP-30 wallet authOAuth 2.0 · PKCE · JWKSTiers from live stakeTelegram + email deliveryEmbedded admin consoledocker compose up -d
Why run it — for operators

Delegation in. Community out.

Your pool already has stakers. Ouro Pass turns them into members you can actually reach.

Stakers become members

Every active delegator signs in with a wallet signature and gets a membership tier computed from live stake. No sign-up forms, no user database to build.

Reach them after they stake

Push announcements, content, and perks to stake-gated channels — Telegram and email today, more on the roadmap. Delegation is the subscription.

Own the relationship

Your members live on your infrastructure, not a platform's. No algorithm decides who sees your updates; no policy change can take your community away.

For your stakers

Staking becomes more than staking.

One signature, one pass

Delegation itself becomes a credential. Sign once with a CIP-30 wallet and the pass works across every service the pool runs — no accounts, no passwords.

Yield, plus everything on top

Staking rewards keep coming — and now also unlock member channels, content feeds, and software services offered by the pool, tiered by stake.

How it works

Identity from signatures, not accounts.

No passwords, no email lists, no custodial middleman. The chain already knows who delegates to you — Ouro Pass turns that fact into a verifiable credential.

01 · PROVE

Wallet signs a challenge

The user's wallet answers a one-time challenge with a CIP-30 signData (COSE) signature. No seed phrases, no keys ever leave the wallet.

02 · MINT

Issuer mints the pass

Your issuer verifies the signature and mints a short-lived JWT — verifiable by any relying party via your published JWKS, with rotatable signing keys.

03 · TIER

Tier from live stake

A rule engine reads active delegation through Koios and assigns a tier. A per-epoch job re-evaluates, downgrading or expiring sessions as stake moves.

Under the hood

Boring standards. One binary.

No token, no custom protocol — just OAuth, JWTs, and wallet signatures, shipped as a single Go binary you run yourself.

  • OAuth 2.0 — authorization_code + PKCE, refresh, introspect (RFC 7662), revoke (RFC 7009), JWKS.
  • Zero custody — CIP-30 signData (COSE) only; user, cold, owner, KES, VRF keys never enter the service.
  • Tier engine — rules over live active stake via Koios; per-epoch reconciliation downgrades or expires as stake moves.
  • Admin console — embedded SPA at /admin with RBAC, owner-wallet login, step-up signing, immutable audit log.
  • Your data — Postgres or SQLite, schema auto-migrates, all state bind-mounted to ./data.
  • One command — Docker Compose with bundled Caddy for automatic HTTPS; multi-arch images on GHCR.
             ┌────────────────────────── your host ──────────────────────────┐

Internet ──▶  caddy (TLS, :80/:443)  ──▶  issuer (:8080, API + /admin + workers)
                                                     │
                                                     ▼
                                              postgres (:5432)

persistent state (bind-mounts) ·· ./data/postgres  ./data/caddy
read-only chain queries ········· issuer ──▶ koios (public per-network endpoints)
caddy automatic HTTPSissuer single Go binarypostgres or SQLite single-hostkoios the only chain read origin
Quick start

Self-hosted in one command.

  • 01Run the installer. It checks prerequisites, fetches the compose stack, and generates secrets.
  • 02Answer two questions — your domain and owner wallet. Caddy handles HTTPS automatically.
  • 03Open /admin and sign in with your owner wallet. You're issuing passes.
Read the full guide 
# one command — inspect-before-run also supported
curl -fsSL https://raw.githubusercontent.com/cauu/ouro-pass/main/deploy/install.sh | sh

# non-interactive (CI / scripted)
curl -fsSL …/install.sh \
  | OURO_DOMAIN=pass.example.com OURO_OWNER_ADDR=stake1… \
    sh -s -- --non-interactive

# updating later: hot backup → pull → restart → health-check
./deploy/update.sh --tag 0.3.0

Your pool. Your members. Your rules.

The delegation is already there — turn it into a community you own. Open source, self-hosted, one command to deploy.

Star on GitHub Read the docs