Where WeftID is going, in rough order. This is direction, not a delivery commitment: priorities move as we ship and learn. WeftID is a multi-tenant SAML and SCIM federation layer that, as of 1.11, is also an OpenID Provider: applications can offer a "Sign in with WeftID" button. What remains is OIDC in the other direction, social sign-in, and an identity layer that SaaS builders can embed.
WeftID is an OpenID Provider: your applications get a "Sign in with WeftID" button, a signed ID token, per-tenant discovery and JWKS endpoints, and scope-gated claims including DAG-aware group memberships. Access is granted by group, the same way SAML apps work.
Put WeftID sign-in in front of HTTP apps that have no SSO of their own: internal dashboards, homelab and small-team tools. Your reverse proxy enforces access; the app stays untouched.
Federate to upstream providers that speak OIDC (Microsoft Entra ID, Google, Okta, Keycloak, Auth0) alongside today's SAML. With the provider side shipped, this closes the loop: OIDC in and OIDC out.
Google, GitHub, Apple, and Microsoft login for end users, built on the same OIDC connector.
Reflect Workspace users and groups into WeftID, the way Okta and Entra already do over SCIM (Workspace does not push SCIM, so this uses the Admin SDK).
Additional vendor profiles on top of today's Slack, GitHub Enterprise, Atlassian, and GitLab.
Provision organizations through an API, let your customers configure their own SSO and SCIM, and integrate through webhooks and hosted login, so a product can ship enterprise-ready identity without building it. Sign in with WeftID is the first piece of this; the control plane is the rest.
Need something on this list sooner? Try WeftID, or start a conversation on GitHub.