Prove
Ask for fresh proof before sensitive actions.
Better Auth Zero Access · by Railman
Take Better Auth beyond sign-in.
Add step-up approval, zero-access vaults, or sealed 1:1 chat to a Better Auth app. Pick what you need and leave the rest.
Publishing as @railman · pre-1.0 · review before production use
What this is
A security suite for Better Auth apps.
Better Auth Zero Access adds step-up approval, browser-held encryption keys, and sealed messaging on top of Better Auth.
Built by Railman, the suite lets Elevate, Vault, and Chat solve different problems. Passkey and PRF anchor Vault and Chat; Elevate can stand alone.
Unlock
Keep encryption keys in the browser, not on your server.
Seal
Store ciphertext and message envelopes without plaintext.
How the suite fits together
Elevate stands alone. Vault and Chat share a passkey core.
The suite is passkey-centered. Elevate is the independent path when password or TOTP step-up is all you need.
existing foundationBetter Auth sessionuser · session · factors
No passkey requiredElevate
@railman/auth-elevatePassword, TOTP, or optional passkey proof for short-lived approval.
Elevate quick start →Passkey-centered stack
Hardened passkey + PRF
enhancePasskey()Vault unlock produces the client-held material that anchors Chat.
Elevate
Ask again before the action matters.
Elevate gives Better Auth apps a short, server-verified approval window for sensitive actions. It works without passkeys, PRF, a MEK, or zero-access storage.
Protect account changes
Require fresh proof before ownership transfer, deletion, or security settings.
Approve billing actions
Put plan changes, payment methods, and invoices behind a short sudo window.
Guard recovery flows
Re-authenticate before users enroll, rotate, or disable recovery methods.
Open admin mode
Grant privileged tools for minutes instead of the full login session.
- 01Sensitive requestAccount, billing, recovery, or admin action
- 02Fresh proofPasskey, TOTP, email OTP, or account password
- 03Approval claimServer-signed and short lived
- 04Action allowedProtected route verifies the claim
No vault key, PRF output, or plaintext enters this path.
smallest setupSession provenance + step-up
Enough for account controls. Nothing here can open a vault.
loginFactors()+twoFactor()+elevate()Choose the proof
Use the method that matches the risk.
Start with password re-entry and TOTP. Add passkey step-up when the same WebAuthn credential should protect login and sudo.
passwordPassword re-entry
Use when password confirmation fits the action’s risk level.
TOTPAuthenticator code
Verify a fresh Better Auth two-factor code for stronger proof.
passkeyPasskey step-up
Use when the same WebAuthn credential should protect login and sudo.
Passkey
Harden WebAuthn where you use it.
@railman/auth-zero-access-passkey freezes RP and origin options, requires user verification, and pairs login with the counter guard.
Harden Better Auth passkeys
Ship the secure options together instead of rebuilding stock WebAuthn settings by hand.
Share one counter guard
Give Elevate the same controller when passkey step-up is enabled.
Unlock the vault
Use PRF helpers when Vault needs browser-held key material.
Vault and Chat keep secrets on the client side of TLS.
Elevate does not need this. Zero-access starts here.Vault
Keep keys in the browser. Store only wrapped material.
@railman/auth-zero-access stores wraps, recovery records, policy metadata, and optional relay data. It never receives vault secrets.
browser onlyMEKPRF outputVault passwordRecovery phrasePlaintext
may cross TLSwrapped MEKKDF parameterssealed envelopespublic proofs
server storesWrap rowsMEK metadataHMAC claimsRate limitsFingerprints
In your product
Encrypt user data without holding their keys.
The server package stays blind. @railman/zero-vault handles create, unlock, reset, and re-enrollment in the browser.
Encrypt user records
Seal notes, files, credentials, and settings with a client-held MEK.
Unlock locally
Use passkey PRF or a vault password in the browser. The server returns wraps, not keys.
Recover safely
Reset access with a recovery phrase and re-enroll daily methods without exposing the MEK.
Grant and revoke
Manage wrapped access methods while the server stores only metadata and ciphertext.
Chat
Seal 1:1 messages on a passkey-centered vault identity.
experimental
@railman/zero-e2e adds X3DH-style session setup and a Double Ratchet. It is not a group or multi-device messaging platform.
What Chat does
Private delivery, peer verification, and rotating keys.
Identity foundation
PasskeyPRFVault unlockIdentity seedZero-e2e consumes the seed; the Vault path performs the passkey and PRF ceremonies.
- Vault-derived identity seed
- Ratchet state
- Message plaintext
Relay
- Public prekey bundle
- Sealed envelope
- Routing metadata
- Vault-derived identity seed
- Ratchet state
- Message plaintext
Session setupX3DH-style prekey exchange
Peer checkSafety-number fingerprint
After deliveryDouble Ratchet rotates message keys
Compare the paths
Same suite, different security jobs.
Elevate can run independently. Vault uses the passkey foundation, and Chat extends the unlocked Vault identity.
| Dimension | CoreElevate@railman/auth-elevate | CoreVault@railman/auth-zero-access | ExperimentalChat@railman/zero-e2e |
|---|---|---|---|
| Best for | Account, billing, recovery, and admin actions | Notes, files, credentials, and private settings | Sealed direct messages between two users |
| User proof | Password, passkey, or authenticator; server gates read the method | Passkey-centered; PRF, vault password, or recovery unlock | Identity seed supplied by the unlocked Vault |
| Client side | No encryption key required | MEK and plaintext stay in the browser | PRF path anchors identity; message keys rotate on the client |
| Server side | Verifies a fresh approval claim | Stores wraps, metadata, and ciphertext | Relays sealed envelopes and routing data |
| Guides | Read the Elevate guide → | Read the Vault guide → | Read the Chat guide → |
Also useful
Packages that make the flows above easier.
Passkey hardens WebAuthn. Login Factors tracks how the session was established. Zero Vault is the browser UX for Vault.
Passkeys
enhancePasskey()
loginFactors()
createVaultClient()
Compare all packages →@railman/auth-zero-access-passkey
enhancePasskey()Hardens Better Auth passkeys and supplies the counter guard and PRF helpers.
Sessions@railman/auth-login-factor
loginFactors()Records how the user signed in and gates routes that need a stronger factor.
Browser vault@railman/zero-vault
createVaultClient()Handles create, unlock, recovery, and re-enrollment in the browser.
Try it
Three labs you can open now.
Hosted data is disposable. Use a lab to see the flow before you wire it into your app.
Docs