RustyAuthGitHubStarsGet started →

Open-source identity infrastructure

Passkeys without
giving up the keys.

RustyAuth is a small, self-hosted Rust service for WebAuthn ceremonies, durable browser sessions and short-lived access tokens.

Get started →View on GitHub ↗Deploy on Railway ↗

Pre-release · Apache-2.0 · Self-hosted

Built in Rust.

Built on SableDB.

Built for passkeys.

Deliberate technology choices

Secure and lightweight.
Ready to scale.

Each layer has one job: Rust protects the public boundary, SableDB keeps identity state compact and private, and typed contracts keep application integrations explicit.

01

Why Rust

Safety without a runtime tax.

  • Memory safety without garbage-collection pauses
  • Predictable latency at the authentication boundary
  • One small binary with a narrow operational surface
  • A mature cryptography and WebAuthn ecosystem
Shipped today
02

Why SableDB

Durable state, without database sprawl.

  • Rust-native, Valkey-compatible persistence
  • Private, volume-backed identity storage
  • Fast atomic pipelines for credentials and sessions
  • A compact topology that remains easy to own
Shipped today
03

Why typed contracts

Protocol clarity across services.

  • Protobuf schemas as an explicit interface
  • Efficient gRPC for trusted service communication
  • Generated clients instead of hand-written payloads
  • Versionable contracts as RustyAuth grows
Shipped today

A deliberately small boundary

Authentication should be
boring in the best way.

RustyAuth authenticates an identity and produces claims. Your application remains responsible for roles, permissions and ownership.

01

WebAuthn

Passkeys, end to end

Registration, authentication and multi-credential management with five-minute, server-side, single-use ceremonies.
02

Sessions

Durable and revocable

HttpOnly sessions with idle and absolute expiry. Raw bearer values never become durable database records.
03

Tokens

Narrow downstream trust

Short-lived ES256 access tokens, public JWKS and explicit issuer, audience, tenant and authentication claims.
04

Storage

Built on SableDB

One private, volume-backed persistence engine for users, credentials, ceremonies, sessions and ordered events.
05

Operations

Fails closed

Automatic signing-key rotation, verified scheduled snapshots, JSON operator receipts and clean-room restore.
06

Ownership

Your identity boundary

Self-hosted infrastructure with no required identity SaaS. Your application keeps authorization and entitlement decisions.

Running in minutes

Three commands.
One identity boundary.

Docker Compose starts RustyAuth on loopback and keeps SableDB private. The local volume survives container replacement.

Read the complete quickstart →
terminal
$ git clone https://github.com/
  rusty-auth/rustyauth.git

$ cd rustyauth
$ cp .env.example .env

$ docker compose up --build

✓ RustyAuth ready on :8081
✓ SableDB private and healthy

Honest by default

Pre-release,
plainly stated.

Passkey registration and sign-inAvailable
Sessions and credential managementAvailable
ES256 tokens and automatic key rotationAvailable
Scheduled backups and clean-room restoreAvailable
Protobuf + gRPC service boundaryAvailable
Account recovery and multi-writer qualificationBefore 1.0

RustyAuth is not yet approved as the sole identity system for a production service. The road to 1.0 is documented in public.

Own the boundary

Build authentication
you can account for.

Explore the docs →Star on GitHub ↗