Documentation

Authentication that never
sees the password.

ZKAuth adds zero-knowledge password proofs, OPAQUE helpers, and WebAuthn helper flows to your app over a single HTTPS API. You get tenant-bound keys, replay protection, and audit logs; the raw password is not transmitted to the platform.

Three authentication surfaces

Choose the method by its threat model and availability. Passkeys are the recommended production primary factor. OPAQUE remains preview work, and the custom Groth16 password path remains experimental.

A login in a few lines

Install zkauth-client, initialize it from trusted server code with your project key, and the proof handshake happens for you:

import { ZKAuthSDK } from 'zkauth-client'
// Proof V2 Lab only: serve the development artifacts on this origin.const proofLabArtifacts = {  wasm: 'http://127.0.0.1:4173/auth_v2.wasm',  zkey: 'http://127.0.0.1:4173/auth_v2.dev-0000.zkey',}
const zkauth = new ZKAuthSDK({  // Load the project key from server-only runtime configuration.  apiKey: loadServerOnlyProjectKey(),  experimentalProofV2Artifacts: proofLabArtifacts,})
const deviceInfo = { deviceName: 'Chrome on Mac', deviceType: 'desktop' }
// Register: the password becomes a commitment on the deviceawait zkauth.register({ email: 'ada@example.com', password, deviceInfo })
// Log in: the server verifies a proof, never the passwordconst res = await zkauth.login({ email: 'ada@example.com', password, deviceInfo })
console.log(res.data.user.id)

Browser-hosted flows can use hosted proxy mode instead of receiving a project API key. Prefer no dependency? Every operation is a plain HTTPS call. See the SDK reference and API reference.

AI and developer handoff

Use the copy bar above when you want another engineer, Cursor, Claude, ChatGPT, or a review tool to understand the project without exposing private configuration.

It copies a safe markdown brief with the public API URL, SDK usage, integration flow, and security rules.

• Safe to share: public URLs, endpoint names, SDK examples, callback flow, and development rules.
• Never share: API keys, JWT secrets, database URLs, Redis URLs, Resend keys, webhook secrets, deployment tokens, or local.env contents.
• Machine-readable brief: /llms.txt.
• Tool behavior: Cursor can open a short prompt link to this brief. Most other tools should be opened normally, then pasted with the copied markdown so long prompts do not leak through URLs.

What the platform gives you

• Projects & keys: live and test keys (zka_live_ / zka_test_), each bound to a single project.
• Replay protection: proof freshness checks and tampered-proof rejection on the hot path.
• Usage & audit logs: per-project request logs and a developer audit trail.
• Teams & webhooks: invite collaborators and subscribe to events with signed, test-deliverable webhooks.

Browse the docs

Every section, end to end.