@authlocal/authlocal
Advanced tools
Authlocal.org is an app where users can create and manage digital login passports.
You can add a "Login with Authlocal" button to your website, allowing users to login using an Authlocal passport.
✨ No emails – users can remain anonymous
🔑 No passwords – passports are cryptographic keypairs
🗿 No databases – everything is stored locally on the user's device
🗽 User-sovereign – users can directly download their passport files
🥷 Privacy-focused – no tracking, except for whatever github pages does
💖 Free and open-source – zero cost at worldwide scale
📱 Clientside – statically hosted on github pages, no api servers
🏛️ Federated – your app can get login tokens from an authlocal.org popup
📜 Protocol – permissionless integration, you can do it your way
🥧 Easy as pie – setup your app with an easy snippet
🥞 Easy as pancakes – logins are fast and painless for users
Pre-release: Authlocal is an unfinished prototype, use at your own risk.
Try out the login button at the Federated Test Page
Choose this installation method if you don't know any better.
<head>:
<script type="module" src="https://authlocal.org/install.bundle.min.js"></script>
<script type="module">
document.querySelector("auth-button").auth.onChange(login => {
if (login) console.log("logged in", login)
else console.log("logged out")
})
</script>
login object looks like this:
login.name // Cetdok Pizafoaba
login.thumbprint // "0d196fc3..."
login.expiry // 1731740481065
login is null.<body>:
<auth-user></auth-user>
<auth-button></auth-button>
localStorage.Choose this installation method if you're familiar with npm, package.json, typescript – stuff like that.
npm i @authlocal/authlocal
main.ts
import {Auth, components, register_to_dom} from "@authlocal/authlocal"
register_to_dom(components)
const auth = Auth.get()
auth.onChange(login => {
if (login) console.log("logged in", login)
else console.log("logged out")
})
index.html
<auth-user></auth-user>
<auth-button></auth-button>
<auth-button src="https://authlocal.org/"></auth-button>
https://authlocal.org/ with your own urlauth.popup to trigger a login, but you should do this in reaction to a user input event, otherwise the browser will block the popup.
import {auth} from "@authlocal/authlocal"
myButton.onclick = async() => {
const login = await auth.popup("https://authlocal.org/")
if (login) console.log("logged in", login)
}
Login object, which has some useful things:
login.proof.token -- this is a Proof token and it's public, so you can send it around anywhere so your user can prove their identitylogin.keys.signClaimToken(~) -- you can use this to sign arbitrary data into a token, which is verifiably signed on behalf of the user's passportimport {Future} from "@authlocal/authlocal"
const idToken = await login.keys.signClaimToken({
expiresAt: Future.hours(24),
// you can pack any abitrary data you want into this token
data: {
username: "Rec Doamge",
avatarId: "d15aea1a",
// perhaps we want to scope this claim to a specific game session,
// so that it cannot be stolen by other users and reused in other
// game sessions.
gameSessionId: "9c22b17e",
},
})
await sendElsewhere(login.proof.token, idToken)
login object comes with a proof token that is required to verify any claim tokens.import {Proof, Claim} from "@authlocal/authlocal"
receiveElsewhere(async(proofToken, idToken) => {
// the origin of your site that triggered the authlocal popup
const allowedAudiences = ["https://example.benev.gg"]
// verifying the proof
const proof = await Proof.verify(proofToken, {allowedAudiences})
// proving the claim
const claim = await Claim.verify(proof, idToken)
// here's that data you packed into the claim
console.log(claim.data.username) // "Rec Doamge"
console.log(claim.data.avatarId) // "d15aea1a"
console.log(claim.data.gameSessionId) // "9c22b17e"
// user passport public thumbprint, the true user identifier
console.log(claim.thumbprint) // "a32e638e..."
console.log(proof.thumbprint) // "a32e638e..."
})
FAQs
User-sovereign Logins For All
We found that @authlocal/authlocal demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A malicious Chrome extension steals newly created MEXC API keys, exfiltrates them to Telegram, and enables full account takeover with trading and withdrawal rights.
Security News
CVE disclosures hit a record 48,185 in 2025, driven largely by vulnerabilities in third-party WordPress plugins.
Security News
Socket CEO Feross Aboukhadijeh joins Insecure Agents to discuss CVE remediation and why supply chain attacks require a different security approach.