01
WebAuthn
Open-source authentication infrastructure for developers
Self-hosted passkey authentication.
1.0.0 GA · Apache-2.0 · Self-hosted
Passwords out.
Short-lived trust.
Customer-controlled.
A deliberately small boundary
Security infrastructure
you can account for.
RustyAuth authenticates an identity and produces claims. Your application remains responsible for roles, permissions, entitlements and resource ownership.
02
Sessions
Durable and revocable
HttpOnly sessions with idle and absolute expiry. Raw bearer values never become durable database records.03
Tokens
Narrow downstream trust
Short-lived ES256 access tokens, public JWKS and explicit issuer, audience, tenant and authentication claims.04
Storage
Private by design
One private, volume-backed SableDB instance for users, credentials, ceremonies, sessions and ordered events.05
Operations
Fails closed
Automatic signing-key rotation, verified scheduled snapshots, JSON operator receipts and clean-room restore.06
Ownership
Your identity boundary
No required hosted identity provider. Your application keeps authorization, entitlement and resource decisions.Developer guides
Evaluate the boundary
before you adopt it.
01
Passkey authentication
Understand WebAuthn registration, sign-in and origin binding.
Read guide →02Self-hosted authentication
Compare deployment models, operational ownership and tradeoffs.
Read guide →03Authentication in Rust
Design a small, fast identity boundary with Rust and SableDB.
Read guide →04Authentication events
Connect signups and identity changes through gRPC streams, polling or signed webhooks.
Read guide →Flagship · RustyAuth Fleet
Many realms.
One operating view.
Manage RustyAuth across clouds, projects and customer environments without centralizing their identity databases. Fleet coordinates the estate while every realm stays independently authoritative.
Explore the Fleet control plane →Management planeRustyAuth Fleet
RailwayProduct APIPrivate SableDB
AWSCustomer portalPrivate SableDB
Customer cloudInstalled productPrivate SableDB
Why now
Attacks move faster.
Trust should get narrower.
AI accelerates phishing and automation while software agents create more paths into valuable systems. RustyAuth starts by removing reusable human credentials and containing downstream access.
Automated credential attacks
Passkeys remove the reusable password and bind authentication to the real relying-party origin.
More machine access
Short-lived tokens and revocable service credentials narrow the trust handed to downstream systems.
Autonomous authority
Purpose-bound grants and constrained agent delegation are the direction—not a hidden feature claim.
Solutions
Start with SaaS.
Go where control matters.
Explore six reference scenarios—from internet-scale products to regulated and disconnected systems—on the dedicated Solutions page.
Fast path for product teams
One launcher.
Three clean boundaries.
The local launcher generates private development secrets and starts the Dioxus dashboard, Rust backend and SableDB with the same separation used for deployment.
Read the complete quickstart →$ git clone https://github.com/
rusty-auth/rustyauth.git
$ cd rustyauth
$ scripts/local-stack standalone up
✓ Dioxus dashboard ready on :8081
✓ Rust backend and SableDB privateHonest by default
GA, plainly scoped.
Available today
Passkeys, revocable sessions, ES256 tokens, automatic key rotation, scheduled backups and clean-room restore.
Continuous assurance
Published-image drills, supported-web coverage, Analytics scale and canary exercises, witnessed recovery and independent assessments continue after GA. Native applications remain post-1.0 previews.
Start with the boundary
Ship passkey authentication
without the identity detour.
Add passkeys without the cost and dependency of another hosted identity platform. Run RustyAuth in infrastructure you control.
The solution stories are illustrative—not customer case studies or compliance claims.
