ZKAuth
Get started

Changelog

Changelog

What is new across the ZKAuth engine and client. Every entry is drawn from the real project history, newest first.

Launch surfaceLatestMohith

Blog, trust copy, and live federation evidence

AddedAdded the public blog, RSS feed, per-page social cards, an About page, and refreshed AI-readable product briefs for launch review.
SecurityValidated a controlled GitHub OAuth browser callback through the helper-owned callback path and kept account linking in manual review when no matching local user exists.
ImprovedUpdated limitations and trust copy so OAuth/OIDC remains preview-scoped, SAML is clearly deferred, and billing is described as foundation work until live activation.
Final local validationMohith

Clean full-platform flow and documentation refresh

ImprovedCompleted a clean generated-data full-platform validation covering signup, signin, project creation, keys, hosted settings, callbacks, security settings, email settings, billing API surfaces, webhooks, organizations, preview federation setup, directory-token listing, usage, logs, and audit filters.
SecurityAdded rate-limit-aware validation guardrails so hosted and ZK login checks are not repeatedly hammered after successful evidence is captured.
FixedAligned local dashboard-to-engine admin-key handling and documented the runtime environment split to avoid repeating dashboard/engine key mismatches.
Source auditMohith

Security-sensitive cleanup without behavior changes

ImprovedSplit selected large dashboard and engine modules behind smaller helpers while preserving CSP, lockout, auth/session, and federation callback behavior.
SecurityVerified current-tree scanner, claim, error-contract, log-hygiene, migration, SDK, dashboard, and engine gates after the source-level audit pass.
ImprovedUpdated trust, security-program, and release-readiness documents so open launch blockers remain explicit instead of hidden in implementation notes.
Trust preparationMohith

Phase 12 evidence and security-program docs

AddedAdded security whitepaper, public threat model, data-flow, data-processing, subprocessor, retention, incident-response, vulnerability-disclosure, and external-review planning documents.
AddedAdded security advisory, security-fix release, dependency update, package support, plugin threat-model, CLI/MCP/agent threat-model, and postmortem process docs.
ImprovedAdded CI evidence and claim-to-test tracking so release readiness can be reviewed from artifacts instead of memory.
OperationsMohith

Status page and operational error contracts

AddedAdded an independent status page with public-safe component status, incidents, maintenance windows, JSON/RSS output, and protected update workflow support.
SecurityAdded the shared error-message contract so user-facing errors, developer errors, and internal operational logs stay separated and redacted.
FixedHardened webhook delivery ownership, emergency reset scoping, and email provider event handling in the engine validation pass.
Phase 8 federation previewMohith

Preview OAuth/OIDC and SCIM setup surface

AddedAdded preview dashboard federation settings for OAuth/OIDC provider configuration, OIDC discovery/JWKS refresh, and reveal-once SCIM token issuance.
SecurityAdded internal SAML security groundwork in the engine, while keeping public SAML availability deferred to a later enterprise release.
ImprovedUpdated public security, limitations, evidence, and AI-readable docs to describe federation as preview-scoped until real-provider runs pass for selected IdPs.
Pre-Phase 8 hardeningMohith

Release-gate evidence refresh

SecurityRefreshed the public limitations, threat model, and evidence pages to include the current hosted handoff, user API-key, organization, audit, and database-separation boundaries without claiming enterprise SSO, SCIM, compliance, or full hosted Account Portal parity.
SecurityAdded an internal migration runbook that requires target classification, table inspection, explicit approval for hosted writes, and rollback or forward-fix planning before schema changes.
ImprovedUpdated release-gate evidence for dashboard, engine, SDK, CLI, policy checks, generated API docs, and non-destructive hosted/full-platform preflights.
zkauth-client v1.4.16Mohith

Developer handoff and hosted flow polish

AddedAdded a safe AI handoff brief and public /llms.txt so developers can give Cursor, Claude, ChatGPT, Perplexity, Grok, Zed, or another coding tool the project context without exposing secrets.
ImprovedPublished zkauth-client v1.4.16 and aligned the developer docs with the hosted engine flow: project setup, callback redirects, email verification, new-device approval, password reset, usage, logs, and webhooks.
SecurityRe-ran the engine security suite covering replay freshness, tenant binding, OPAQUE, WebAuthn, recovery-code hardening, API-key validation, and sensitive logging.
SecurityRefreshed dashboard and engine dependency lockfiles and reviewed the current dependency audit results.
zkauth-client v1.4.13Mohith

Client release

ImprovedStabilized the SDK integration suite across the hosted register and login paths.
ImprovedCircuit pre-loading in the browser for faster first proof.
Hosted platformMohith

Verification milestone

ImprovedFull hosted verification suite passing across ZK login, OPAQUE, WebAuthn, teams, and webhooks.
FixedLogin benchmark stabilized across repeated local runs.
OperationsMohith

Release hardening

FixedTightened the deployment process to an authorized release author.
EngineMohith

Runtime reliability

FixedResolved serverless cold-start startup issues.
ImprovedPinned the Node 20 runtime for consistent ZKP verifier initialization.
ZKAuth-H research upgradeMohith

Hybrid authentication

AddedOPAQUE (PAKE) credential persistence and single-use login sessions.
AddedWebAuthn passkey persistence with single-use challenges.
ImprovedPer-tenant email uniqueness for clean multi-tenant isolation.
RemovedKnowledge-based (cognitive question) recovery, and unused legacy tables.
Developer platformMohith

Usage visibility

AddedPer-project API usage logging and per-client usage tracking.
EngineMohith

Performance & email

ImprovedTuned Argon2id parameters for faster login without changing the password-verification model.
AddedEmail verification redirect flow with asynchronous delivery.
ImprovedMulti-tenant email handling and verification.
SecurityMohith

Stronger hashing

SecurityMigrated password key derivation from PBKDF2 to Argon2id.
LaunchMohith

ZKAuth engine

AddedTenant-bound Groth16 zero-knowledge authentication with replay protection.
AddedMulti-tenant client isolation and live/test API keys, deployed on Vercel.
PreviousDeployment