Better Auth Zero Access
A passkey-centered security suite with standalone step-up, zero-access vaults, and Vault-backed E2E chat.
Security beyond sign-in
Better Auth Zero Access is a passkey-centered suite by Railman. Vault and Chat share a hardened WebAuthn and PRF foundation; Elevate can run independently with password, TOTP, or an optional passkey.
The suite provides:
- standalone step-up / sudo that never unlocks encrypted data
- a blind key store for browser-held master encryption keys (MEKs)
- hardened passkey and PRF ceremonies for Vault unlock
- sealed 1:1 Chat on a Vault-derived identity seed
Password or TOTP works without Vault, PRF, or passkeys.
MEK and plaintext stay in the browser.
Zero-e2e consumes the seed after Vault unlock.
Live demos
| Elevate | Step-up lab — methods, L0/L1 gates, config catalog. No vault. |
| Vault | Full ceremony: create, unlock, seal, recovery |
| Chat | Vault-layered E2E messaging with safety numbers |
The demos share one app shell and Better Auth session. That shared shell is lab UX: Chat still derives its identity from the unlocked Vault path.
The rule worth memorizing
| Layer | Meaning | Does not do |
|---|---|---|
| L0 Session | Browser is signed in | Unlock encrypted data |
| L1 Elevate | User just re-proved | Unwrap the MEK |
| L2 Vault unlock | MEK is in tab memory | Grant admin routes |
How it works has a clearer diagram. Background covers terms, crypto, and packages. Extended reading: WebAuthn and PRF, Crypto primitives, Crypto and package rationale.
Who this is for
- Teams on Better Auth that need sudo without inventing session claims
- Products that need passkey PRF unlock, optional vault password, BIP-39 recovery
- Apps that keep step-up and encryption as separate control planes
Packages
| Package | Primary API | Feature |
|---|---|---|
@railman/auth-zero-access | zeroAccess() | Passkey-centered blind MEK store, wraps, recovery |
@railman/auth-zero-access-passkey | enhancePasskey(passkey, …) | Guard + stock options + browser PRF |
@railman/auth-elevate | elevate() · requireElevate() | L1 step-up (passkey optional) |
@railman/auth-login-factor | loginFactors() · requireAccess() | L0 stamps and gates |
@railman/zero-vault | createVaultClient() | Create / daily unlock / reset |
@railman/zero-e2e | X3DH + Double Ratchet | Chat primitives on a Vault-derived identity |
Full map and per-package getting started: Packages overview. HTTP paths and helpers: API & specs.
Start here
Packages
Overview + getting started per package
API & specs
HTTP endpoints, helpers, M6
Use cases
Pick a path, then open its compose guide
Quick start
Full production sketch
Elevate and sudo
With or without passkeys
How it works
L0 · L1 · L2
WebAuthn & PRF
Passkey jobs and vault unlock
Crypto primitives
Inventory and decisions
Crypto & package rationale
Why these choices and upstreams