Initial ZKAuth engine
The first engine release introduced tenant-bound Groth16 authentication with challenge freshness and replay protection.
Mohith / 4 min readWhat shipped
The initial engine could bind a Groth16 authentication statement to one project and a fresh server challenge, then reject reuse after successful verification.
The critical sequence was already challenge before proof: obtain server context, generate the client proof for that context, then submit it for one verification attempt.
1. POST /api/v1/auth/zk/challenge2. Generate the proof on the client for that challenge3. POST /api/v1/auth/login4. Consume the challenge during successful verificationHow to read this history
This entry records the original engine milestone. Later releases tightened request binding, project-key isolation, hosted flows, and production gates; the current documentation is authoritative for new integrations.
The present Proof V2 password path remains experimental pending independent cryptographic review and a production ceremony. This historical milestone is not evidence that the current research path is cleared for production.