FAQ
Common questions about zero-access, vault unlock, and elevate.
FAQ
Is this end-to-end encryption for everything?
No. It is a zero-knowledge-oriented, server-blind vault pattern for Better Auth: the server stores wrapped master keys and optional sealed payloads. Your app still decides what to encrypt with the MEK, and the server remains trusted for availability and authorization.
Does elevate open the vault?
No. Elevate (L1) is step-up for privileged account actions. Vault unlock (L2) is a separate client ceremony using PRF, vault password, or recovery phrase.
Does the server ever see PRF output?
No. PRF runs in the browser/authenticator. The client may upload a wrap slot (ciphertext + parameters). That is not the PRF secret.
Can I use the recovery phrase every day?
You can technically unwrap with it, but product policy should treat recovery as reset / break-glass. Daily unlock should be passkey PRF and/or vault password.
What if the authenticator does not support PRF?
Surface a clear error (PrfUnavailableError) and fall back to vault password if provisioned, or recovery reset + re-enroll.
Do I need all six packages?
No. Match the use case:
| Goal | Minimum |
|---|---|
| Sudo / step-up only | auth-elevate + auth-login-factor (+ optional twoFactor) |
| Passkey login | enhancePasskey from auth-zero-access-passkey + @better-auth/passkey |
| Passkey + elevate | Above + elevate({ passkeyCounterGuard }) |
| Blind wrap store / vault | Passkey composition + auth-zero-access (guard auto-bound) + zero-vault |
| E2E chat | Vault path + zero-e2e |
Why does zero-e2e not import the passkey package?
Because it operates below the browser ceremony layer. The Chat product path gets its identity seed from the passkey-centered Vault unlock, then passes that seed into zero-e2e. Keeping WebAuthn out of the crypto primitive API does not make Chat an independent product path.
Are packages published on npm?
They ship under the @railman scope from railmanio/auth-zero-access. Packages are still private: true today — install via git / workspace until a public npm release. The hosted lab uses them in-process.
Is the demo production data?
No. Hosted D1 may wipe. Treat vaults and chat as disposable lab state.
Where are engineer audit notes?
In the monorepo under docs/ (attack surface IDs, audit log). The public site is product documentation only.