RustyAuthGitHubStarsGet started →

Passkey authentication infrastructure

Authentication for the
agentic threat era.

Ship passkey-first authentication without building the identity stack yourself. Run it in your cloud, your customer’s infrastructure, or disconnected environments.

Start locally →Explore solutions →

0.1.0 pre-release · Apache-2.0 · Self-hosted

Passwords out.

Short-lived trust.

Customer-controlled.

A deliberately small boundary

Security infrastructure
you can account for.

RustyAuth authenticates an identity and produces claims. Your application remains responsible for roles, permissions, entitlements and resource ownership.

01

WebAuthn

Passkeys, end to end

Registration, authentication and multi-credential management with five-minute, server-side, single-use ceremonies.
02

Sessions

Durable and revocable

HttpOnly sessions with idle and absolute expiry. Raw bearer values never become durable database records.
03

Tokens

Narrow downstream trust

Short-lived ES256 access tokens, public JWKS and explicit issuer, audience, tenant and authentication claims.
04

Storage

Private by design

One private, volume-backed SableDB instance for users, credentials, ceremonies, sessions and ordered events.
05

Operations

Fails closed

Automatic signing-key rotation, verified scheduled snapshots, JSON operator receipts and clean-room restore.
06

Ownership

Your identity boundary

No required hosted identity provider. Your application keeps authorization, entitlement and resource decisions.

Why now

Attacks move faster.
Trust should get narrower.

AI accelerates phishing and automation while software agents create more paths into valuable systems. RustyAuth starts by removing reusable human credentials and containing downstream access.

01

Automated credential attacks

Passkeys remove the reusable password and bind authentication to the real relying-party origin.

Available now
02

More machine access

Short-lived tokens and revocable service credentials narrow the trust handed to downstream systems.

Available now
03

Autonomous authority

Purpose-bound grants and constrained agent delegation are the direction—not a hidden feature claim.

Product direction

Solutions

Start with SaaS.
Go where control matters.

Explore six reference scenarios—from internet-scale products to regulated and disconnected systems—on the dedicated Solutions page.

01SaaS02Gambling and gaming03Banking and payments04Financial services05Healthcare products06Defence and secure systems

Fast path for product teams

One launcher.
Three clean boundaries.

The local launcher generates private development secrets and starts the Dioxus dashboard, Rust backend and SableDB with the same separation used for deployment.

Read the complete quickstart →
terminal
$ git clone https://github.com/
  rusty-auth/rustyauth.git

$ cd rustyauth

$ scripts/local-stack standalone up

✓ Dioxus dashboard ready on :8081
✓ Rust backend and SableDB private

Honest by default

Pre-release, plainly stated.

Available today

Passkeys, revocable sessions, ES256 tokens, automatic key rotation, scheduled backups and clean-room restore.

Before 1.0

Account recovery, abuse controls, multi-writer qualification and an independent security assessment.

Start with the boundary

Ship passkey authentication
without the identity detour.

Add passkeys without the cost and dependency of another hosted identity platform. Run RustyAuth in infrastructure you control.

Start locally →Find your scenario →

The solution stories are illustrative—not customer case studies or compliance claims.