README_en.md
简体中文 | 繁體中文 | English | 日本語 | 한국어 | Русский
<p align="center"> </p> <h1 align="center" style="margin: 30px 0 30px; font-weight: bold;">Sa-Token v1.46.0</h1> <h4 align="center">✨ Open source, free, one-stop java permission authentication framework, making authentication simple and elegant! </h4> <p align="center"> <a href="https://gitee.com/dromara/sa-token/stargazers"></a> <a href="https://gitee.com/dromara/sa-token/members"></a> <a href="https://atomgit.com/dromara/sa-token/stargazers"></a> <a href="https://github.com/dromara/sa-token/stargazers"></a> <a href="https://github.com/dromara/sa-token/network/members"></a> <!-- <a href="https://github.com/dromara/sa-token/watchers"></a> --> <!-- <a href="https://github.com/dromara/sa-token/issues"></a> --> <a href="https://github.com/dromara/sa-token/blob/master/LICENSE"></a> </p> <!-- <p align="center"> To learn and test, please pull the master branch, dev is in the development branch (execute `git checkout master` in the root directory) </p> --> <p align="center"> <a href="https://sa-token.com?way=readme" target="_blank"> Online documentation: https://sa-token.com</a> | <a href="https://sa-token.com/doc.html#/more/demand-commit" target="_blank">Request submission</a> </p>Looking back at the beginning of 2020, when I submitted the first line of code for Sa-Token, what Java on the market lacked at that time was not only a simple and easy-to-use authentication framework, but also a set of clear and self-consistent permission architecture design ideas.
Therefore, in the past few years, I have devoted a lot of time to writing Sa-Token documentation. Almost every chapter, every sentence, and every word has been repeatedly revised and finely polished in order to achieve the clearest, most concise, and easy-to-understand expression. Read the documentation carefully, and you will learn not only the Sa-Token framework itself, but also the best practices for permission design in most scenarios.
Sa-Token is a lightweight Java permission authentication framework that currently has five core modules: login authentication, permission authentication, single sign-on, OAuth2.0, and microservice authentication.
Still hand-rolling these features? Stop ⚠️ Let Sa-Token handle them!
To use Sa-Token in a SpringBoot project, you only need to introduce dependencies in pom.xml:
<!-- Sa-Token authority authentication, online document: https://sa-token.com -->
<dependency>
<groupId>cn.dev33</groupId>
<artifactId>sa-token-spring-boot-starter</artifactId>
<version>1.46.0</version>
</dependency>
In addition to Spring Boot 2, Sa-Token also provides integration packages for common web frameworks such as Spring Boot 3/4, Solon, and JFinal — truly out of the box.
<details> <summary><b>Simple examples:</b> (click to expand / collapse)</summary>Sa-Token aims to complete the permission authentication part of the system in a simple and elegant way. Taking login authentication as an example, you only need:
// Session login, the parameter is filled in the account id of the login person
StpUtil.login(10001);
There is no need to implement any interface or create any configuration file. You only need to call this static code to complete the session login authentication.
If an interface requires login before accessing it, we only need to call the following code:
// Verify whether the current client has logged in, if not, throw `NotLoginException` exception
StpUtil.checkLogin();
In Sa-Token, most functions can be solved with one line of code:
Kick people offline:
// Kick the session with account ID 10077 offline
StpUtil.kickout(10077);
Permission authentication:
// Annotation authentication: Only sessions with `user:add` permission can enter the method
@SaCheckPermission("user:add")
public String insert(SysUser user) {
// ...
return "用户增加";
}
Route interception authentication:
// Divide modules according to routes, and different modules have different authentication
registry.addInterceptor(new SaInterceptor(handler -> {
SaRouter.match("/user/**", r -> StpUtil.checkPermission("user"));
SaRouter.match("/admin/**", r -> StpUtil.checkPermission("admin"));
SaRouter.match("/goods/**", r -> StpUtil.checkPermission("goods"));
SaRouter.match("/orders/**", r -> StpUtil.checkPermission("orders"));
SaRouter.match("/notice/**", r -> StpUtil.checkPermission("notice"));
// More modules...
})).addPathPatterns("/**");
If you have used Shiro or SpringSecurity before, you will experience a qualitative leap after switching to Sa-Token.
<!-- When you are fed up with frameworks such as Shiro and SpringSecurity, you will understand how simple and elegant Sa-Token's API design is compared to these traditional old frameworks! --> </details> <details> <summary><b>Core module list:</b> (click to expand/collapse)</summary>Sa-Token SSO is divided into three modes, which can solve the SSO authentication requirements under 同域、跨域、共享Redis、跨Redis、前后端一体、前后端分离、纯 js、vue2、vue3、java 项目、非 java 项目 and other architectures:
| System Architecture | Adoption Patterns | Introduction | Documentation Links |
|---|---|---|---|
| Front-end in the same domain + back-end in the same domain as Redis | Mode 1 | Shared cookie synchronization session | Document, Example |
| Different domains on the front end + the same backend as Redis | Mode 2 | URL redirection propagation session | Document, Example |
| Different front-end domains + different back-end Redis | Mode 3 | HTTP request to obtain session | Document, Example |
c1.domain.com, c2.domain.com, c3.domain.comhttp://a.com?id=1&name=2, and after successful login, it became: http://a.com?id=1. Sa-Token-SSO has a special algorithm to ensure that parameters are not lost, and the original path is accurately returned after successful login.The Sa-Token OAuth2 module is divided into four authorization modes to solve the authorization needs in different scenarios.
| Authorization Model | Introduction |
|---|---|
| Authorization code format | OAuth2 standard authorization steps, the server side releases the code, and the client side obtains the code code and redeems it for access_token |
| Hidden | Alternative option, the server uses URL redirection to directly transfer the access_token to the client page |
| Password type | The client directly exchanges the user's account password for authorization access_token |
| Client certificate type | The server-side client_token for the client level represents the resource authorization of the application itself |
Detailed reference document: https://sa-token.com/doc.html#/oauth2/readme
1. Does Sa-Token have a complete feature set?
Seven years of hard work: five core modules (login, authentication, SSO, OAuth2, microservices) + many practical plug-ins (short token, jwt integration, API parameter signature, API Key authorization...) We provide not only permission authentication, we provide a one-stop solution.
2. Is Sa-Token easy to learn?
Chinese documentation + Chinese code comments + Chinese communication community + a large number of practical case blogs + multiple video tutorials + a large number of outstanding open source project integration cases.
3. Are there many people using Sa-Token?
As of the statistics date (2026-1-25), Sa-Token is in:
This is the data that many developers voted with their feet. I believe these data can prove the popularity of Sa-Token better than any words.
4. What authoritative certification does Sa-Token have?
Honors include but are not limited to: Gitee GVP Most Valuable Open Source Project, GitCode G-Star High-Quality Open Source Project, OSCHINA 2021 Popularity Index TOP 30 Open Source Project, OSCHINA 2022 One of the Most Popular Chinese Open Source Project Communities, Open Atomic Foundation 2023 Fast-Growing Open Source Project, Dromara Organization Top Project (One), Preparatory Member of the Trusted Open Source Community Community, and the open source community "Dromara" where he works Won the second prize in the "2024 China Internet Development Innovation and Investment Competition (Open Source)". Gitee High Star project (5000+star). Gitee's Top 2 Open Source Projects for Web Application Development in 2025.
5. Is there any charge for Sa-Token?
Sa-Token adopts the Apache-2.0 open source protocol and promises that the framework itself and online documents will always be free and open. Of course, if you are interested in sponsoring Sa-Token, we will not shy away from it: Sponsorship Link. We will regularly synchronize the sponsor list to the online document display. (One thing you need to note is: this sponsorship is only a friendly sponsorship and does not provide any commercial exchange)
6. Is Sa-Token an encapsulated SpringSecurity? Is it a shell of ApacheShiro?
No. Sa-Token is not a backend template, nor is it a secondary encapsulation shell for the xx framework, but a pure self-developed framework starting from scratch, with zero dependencies on the core package, a completely independent and controllable architecture core + integrated adaptation of many mainstream frameworks.
There are more excellent open source cases that cannot be displayed one by one, please refer to: Awesome-Sa-Token
Sa-Token community members contributed multi-language implementation versions:
We sincerely invite developers who are more proficient in the above languages to build relevant versions together. 🤝
We have separately produced corresponding integration examples for almost all technical points of the framework. This compressed package has a total of 60+ Demo: covering all aspects of authentication and authentication such as Sa-Token login authentication, authority authentication, SSO single sign-on, OAUth2 unified authentication, microservice authentication, API Key authentication, JWT integration, cross-system call parameter signature verification, etc.
Download address: https://sa-token.com/doc.html#/more/download-demos
QQ communication group: 1098917026 Click to join
WeChat communication group:
<!-- -->PS: Scan the QR code to add WeChat (remark: sa-token) to invite you to join the group chat.
Benefits of joining a group chat: