---
title: "Open source at Optimi"
description: "Optimi open-source projects: local OIDC for development (oauthsonas) and bounded-memory URL clustering for analytics (clusterpath)."
canonical_url: https://optimi.com/en/docs/open-source
md_url: https://optimi.com/en/docs/open-source.md
last_updated: 2026-09-04
---

# Open source at Optimi

Optimi publishes focused open-source tools that solve the same problems we hit
when building edge platforms: realistic local authentication for integration
tests, and safe URL cardinality reduction before analytics indexing.

Both projects are **MIT-licensed**, written in Go, and maintained under the
[optimiweb](https://github.com/optimiweb) organization on GitHub.

## Projects

| Project | What it does | Repository |
| --- | --- | --- |
| **[oauthsonas](/en/docs/oauthsonas)** | In-memory OpenID Connect provider for local development and integration tests | [github.com/optimiweb/oauthsonas](https://github.com/optimiweb/oauthsonas) |
| **[clusterpath](/en/docs/clusterpath)** | Bounded-memory URL normalizer that collapses high-cardinality paths into stable templates | [github.com/optimiweb/clusterpath](https://github.com/optimiweb/clusterpath) |

## When to use which

- Use **oauthsonas** when a relying party (dashboard, API gateway, SPA) needs a
  real browser Authorization Code + PKCE flow in CI or on a laptop — without
  Auth0, Okta, or Keycloak, and without stubbing the OIDC client.
- Use **clusterpath** when a high-volume request log would explode a ClickHouse
  (or similar) dictionary of distinct URLs. It learns structural templates
  online and emits a fixed vocabulary of placeholders such as `{id}` and
  `{hex}`.

## Design principles

These libraries share the same product posture as the managed platform:

- **Small and intentional.** No databases, no admin UIs, no production identity
  or multi-tenant control planes unless that is the problem being solved.
- **Safe defaults.** oauthsonas binds to loopback and refuses non-loopback
  exposure unless you opt in. clusterpath bounds memory by construction.
- **Observable contracts.** Stable selectors for browser automation, versioned
  form posts, typed placeholders, and health endpoints where they matter.
- **Documented failure modes.** Single-replica limits, restart invalidation,
  and dictionary versioning are first-class in the docs — not footnotes.

## License and contribution

Both projects use the MIT license. Contributions are welcome through GitHub
issues and pull requests. Run the project's test suite (`go test -race ./…`
where applicable) before opening a PR, and keep the development-only security
model of oauthsonas intact.

## Next steps

1. **[oauthsonas](/en/docs/oauthsonas)** — run the local OIDC provider and wire a
   dashboard.
2. **[oauthsonas configuration](/en/docs/oauthsonas/configuration)** — clients,
   personas, and claim names.
3. **[clusterpath](/en/docs/clusterpath)** — normalize a URL stream with the
   library or CLI.
4. **[clusterpath metrics](/en/docs/clusterpath/metrics)** — budgeted 96-ID
   metric clusters for dashboards.