WebAuthn
Passkey authentication infrastructure
0.1.0 pre-release · Apache-2.0 · Self-hosted
Passwords out.
Short-lived trust.
Customer-controlled.
A deliberately small boundary
Security infrastructure
you can account for.
RustyAuth authenticates an identity and produces claims. Your application remains responsible for roles, permissions, entitlements and resource ownership.
Sessions
Durable and revocable
HttpOnly sessions with idle and absolute expiry. Raw bearer values never become durable database records.Tokens
Narrow downstream trust
Short-lived ES256 access tokens, public JWKS and explicit issuer, audience, tenant and authentication claims.Storage
Private by design
One private, volume-backed SableDB instance for users, credentials, ceremonies, sessions and ordered events.Operations
Fails closed
Automatic signing-key rotation, verified scheduled snapshots, JSON operator receipts and clean-room restore.Ownership
Your identity boundary
No required hosted identity provider. Your application keeps authorization, entitlement and resource decisions.Why now
Attacks move faster.
Trust should get narrower.
AI accelerates phishing and automation while software agents create more paths into valuable systems. RustyAuth starts by removing reusable human credentials and containing downstream access.
Automated credential attacks
Passkeys remove the reusable password and bind authentication to the real relying-party origin.
More machine access
Short-lived tokens and revocable service credentials narrow the trust handed to downstream systems.
Autonomous authority
Purpose-bound grants and constrained agent delegation are the direction—not a hidden feature claim.
Solutions
Start with SaaS.
Go where control matters.
Explore six reference scenarios—from internet-scale products to regulated and disconnected systems—on the dedicated Solutions page.
Fast path for product teams
One launcher.
Three clean boundaries.
The local launcher generates private development secrets and starts the Dioxus dashboard, Rust backend and SableDB with the same separation used for deployment.
Read the complete quickstart →$ git clone https://github.com/
rusty-auth/rustyauth.git
$ cd rustyauth
$ scripts/local-stack standalone up
✓ Dioxus dashboard ready on :8081
✓ Rust backend and SableDB privateHonest by default
Pre-release, plainly stated.
Passkeys, revocable sessions, ES256 tokens, automatic key rotation, scheduled backups and clean-room restore.
Account recovery, abuse controls, multi-writer qualification and an independent security assessment.
Start with the boundary
Ship passkey authentication
without the identity detour.
Add passkeys without the cost and dependency of another hosted identity platform. Run RustyAuth in infrastructure you control.
The solution stories are illustrative—not customer case studies or compliance claims.