01
- Zero-knowledge biometric
-Client-generated Groth16 proofs. The verifier sees the proof, not the user.
- /v1/verifications -+ A drop-in identity API built on zero-knowledge cryptography. + The biometric never leaves the device. The server never sees it. + What we store cannot be reversed, replayed, or sold. +
+- A drop-in identity API built on zero-knowledge cryptography. - The biometric never leaves the device. The server never sees it. - What we store cannot be reversed, replayed, or sold. -
-- Passwords leak. Templates leak. Even hashes leak — given a database and time. -
-
- We removed the thing an attacker could steal. There is no stored credential, no
- retained biometric, no shared secret. Just a proof — generated on the
- user's device, verified by mathematics, gone in a hundred milliseconds.
+
+
+ A real-time simulation of the protocol — enrollment, client-side proof generation,
+ on-chain anchoring, and verification. The biometric never leaves the simulated device.
- ZeroAuth replaces the credential database with a verifier. The same engine
- powers zero-knowledge biometric, SAML 2.0, and OIDC under one API and one
- audit trail.
+
+ Spin up a tenant from the dashboard, grab an API key, and start issuing
+ zero-knowledge proofs from any backend. SDKs for Node and Python; the
+ REST API works from anywhere.
Client-generated Groth16 proofs. The verifier sees the proof, not the user. Standards-compliant Service Provider for any IdP — Okta, Azure AD, Ping, ADFS. Authorization-code flow with PKCE, discovery, JWKS, and userinfo. Sign up to create a tenant. You'll get a za_test_… key for development and a separate za_live_… key for production. POST a Poseidon commitment from the client SDK. ZeroAuth stores the commitment — never the underlying biometric. On every login, send the Groth16 proof to /v1/verifications. Get back a verified principal in under 100 ms.
- The complete flow, from enrollment to verification, is three HTTP calls — each
- replay-safe, each idempotent, each producing a row in a tamper-evident audit log.
+
+ The user proves they hold a biometric on their device. Only a Poseidon
+ commitment and a Groth16 proof ever cross the network. Raw embeddings
+ stay in memory and are destroyed after hashing.
- The client submits a Poseidon commitment derived from the user's biometric.
- The commitment is one-way. The original buffer is destroyed in memory before
- the response is sent.
-
- On every sign-in the client constructs a Groth16 zero-knowledge proof that
- the commitment matches what only the user can produce. The proof is opaque
- and bound to a server-issued challenge.
-
- Your server posts the proof to /v1/verifications.
- ZeroAuth verifies it cryptographically and returns a signed principal,
- audited and rate-limited per tenant.
- The user creates a credential on their own device. A cryptographic commitment is generated and stored — never the credential itself. At login, a Groth16 zero-knowledge proof is generated on the device. It mathematically proves the user knows the credential — without transmitting any part of it. Proofs are verified against the commitment using succinct verification. Works on-chain via smart contracts or off-chain with a lightweight verifier.
- Sign up, generate an API key, and verify a proof. The full reference
- implementation runs locally on Docker in under two minutes.
+
+ A typed REST API, a developer console, granular audit logs, and a
+ separation between live and test environments — so you can ship
+ without flying blind.
+ In October 2023, Okta's support breach exposed every support customer's data
+ and shaved more than 11% off the share price. In May 2024 an Indian
+ contractor leaked 496 GB of biometric data. Here is the same scenario,
+ with ZeroAuth.
+
+
Every cryptographic choice, every architectural decision, every threat is
- documented in the open. The full source — including the verifier, the circuit,
- and the on-chain contracts — is MIT licensed.
+ documented in the open. The full source — verifier, circuit, on-chain
+ contracts — is MIT licensed.
+ Self-serve gets you to production for most workloads. For regulated
+ industries or on-prem requirements, our team works directly with your
+ security org — no rip-and-replace required.
+ Your database becomes worthless to attackers. No password hashes, no tokens, no session secrets to exfiltrate. Works alongside your existing IdP. Integrates via standard APIs and SDKs. Deploy in days, not quarters. Designed for SOC 2, GDPR, DPDP, and HIPAA. Less data stored means less data to govern. Built on peer-reviewed cryptographic primitives: Groth16 proofs, Poseidon hashing, and elliptic-curve pairings.
Pramaan is the zero-knowledge biometric identity protocol underlying ZeroAuth.
The paper describes the construction, the security reductions, the on-chain
@@ -925,8 +1372,7 @@
Written for cryptographers and platform engineers. Includes the formal proof
- of soundness, the circuit specification, and the recommended deployment
- topology.
+ of soundness, the circuit specification, and the recommended deployment topology.
+
-
+
-
+ Live demo
+
+ A signup, end to end.
+
-
-
- 00
- Secrets stored. The database holds commitments, not credentials.
-
- 00
- Biometric bytes transmitted. The proof leaves the device. The biometric never does.
+
+
-
-
-
- 100%
- Mathematically verified. Soundness reduces to discrete-log on BN128.
+
+
-
- The product
-
- One verifier. Three surfaces.
+
+ Quickstart
+
- Up and running in five lines.
-
@@ -778,85 +1062,161 @@ 01
- Zero-knowledge biometric
- 02
- SAML 2.0
- 03
- OAuth 2.0 · OIDC
-
+
+
+
+
+
+ 01Get an API key
+
+
+ 02Register a user
+
+
+
+ 03Verify the proof
+
+
+
+
+
+
+
+
+
+
+
+ # 1. Register a user with a commitment
+curl -X POST https://zeroauth.dev/v1/users/register \
+ -H "Authorization: Bearer $ZEROAUTH_API_KEY" \
+ -H "Content-Type: application/json" \
+ -d '{
+ "external_id": "user_42",
+ "commitment": "0x1f3c…"
+ }'
+
+# 2. Verify a Groth16 proof at login
+curl -X POST https://zeroauth.dev/v1/verifications \
+ -H "Authorization: Bearer $ZEROAUTH_API_KEY" \
+ -H "Content-Type: application/json" \
+ -d '{
+ "external_id": "user_42",
+ "proof": { "a": [...], "b": [...], "c": [...] },
+ "public_signals": ["0x1f3c…"]
+ }'
+
+
+
+ import { ZeroAuth } from '@zeroauth/sdk';
+
+const za = new ZeroAuth({ apiKey: process.env.ZEROAUTH_API_KEY });
+
+// 1. Register a user from your backend
+await za.users.register({
+ externalId: 'user_42',
+ commitment, // from client SDK
+});
+
+// 2. Verify a proof on login
+const { verified, principal } = await za.verifications.create({
+ externalId: 'user_42',
+ proof,
+ publicSignals,
+});
+
+if (verified) issueSession(principal);
+
+
+ from zeroauth import ZeroAuth
+
+za = ZeroAuth(api_key=os.environ["ZEROAUTH_API_KEY"])
+
+# 1. Register a user
+za.users.register(
+ external_id="user_42",
+ commitment=commitment,
+)
+
+# 2. Verify a proof
+result = za.verifications.create(
+ external_id="user_42",
+ proof=proof,
+ public_signals=public_signals,
+)
+
+if result.verified:
+ issue_session(result.principal)
+ OAuth 2.0 · OIDC
-
+
-
How it works
-
- Three calls. End to end.
+ Three steps. Zero secrets exposed.
-
-
-
- 01
-
- Register a commitment
-
- 02
-
- Generate a proof
-
- 03
-
+ Verify and proceed
-
+
User enrolls on-device
+ // On the user's device
+const secret = generateCredential();
+const commitment = poseidonHash(secret);
+register({ commitment });
+ ZK proof generated client-side
+ // Client-side proof generation
+const proof = await groth16.prove(
+ circuit, { secret, commitment }
+);
+authenticate({ proof });
+ Succinct verification
+ // Server or smart contract
+const valid = groth16.verify(
+ verificationKey, proof, signals
+);
+// secrets exposed: 0
+
-
- Quickstart
-
- Five lines, two endpoints.
+
+ Built for developers
+
- Everything you expect from a modern auth API.
-
+
+
-# → 200 OK · { "verified": true, "principal": "…" }
-
+
+
+
+
-
+ What a breach costs
+
+ A $25M lesson, side by side.
+
- Full API reference
+
@@ -865,40 +1225,38 @@
+
The cost of stored credentials
+ October 2023
+ Records exposedAll support customers
+ Incident response$2.1M+
+ Legal & regulatory$8M+
+ Customer churn$15M+
+ Stock price impact−11.6%
+
+ Total damage
+ $25M+
+
+ The cost of zero-knowledge
+ Database fully exfiltrated
+ Records exposed0 usable
+ Incident response$0
+ Legal & regulatory$0
+ Customer churn$0
+ Credential resetNone required
+
+ Total damage
+ $0
+
+ Five lines, two endpoints.
-
+
Engineering
- No magic. Just primitives, written down.
-
-
+
-
-
-
-
-
-
-
-
-
-
+
-
+
+
+
+
+
+
+
+
+
Architecture decision records
Public threat model
API contract
@@ -909,15 +1267,104 @@
-
+
+ No magic. Just primitives, written down.
+
+
+
+
+
+ Enterprise
+
+ SOC 2, SSO, or a private deployment?
+
+
+
+
+
+
+
+
+
+
+
+ Zero-trust by default
+
+
+
+
+
+ Drop-in integration
+
+
+
+
+
+ Compliance-ready
+
+
+
+
+
+ Mathematically proven
+
-
+
White paper
-
- The cryptographic foundation.
+ The cryptographic foundation.
+
@@ -992,6 +1440,7 @@ The cryptographic foundation.
Company
@@ -1009,6 +1458,69 @@ Company