Getting started — Zero-access

@railman/auth-zero-access is the Better Auth blind key store: MEK metadata, wrap slots (prf / password / recovery), account recovery, and optional E2E relay. The server never holds the MEK, mnemonic, PRF secret, or vault password.

Guide: Vault · HTTP: API — Zero-access

Install

pnpm add @railman/auth-zero-access @railman/auth-zero-access-passkey @better-auth/passkey

Server composition (documented vault path)

Install the passkey stack in the same Better Auth instance; Zero Access discovers and binds the exact guard automatically:

import { passkey } from "@better-auth/passkey";
import { enhancePasskey } from "@railman/auth-zero-access-passkey";
import { zeroAccess } from "@railman/auth-zero-access";

const passkeyStack = enhancePasskey(passkey, {
  rpID: "example.com",
  origin: ["https://example.com"],
  assertCredentialAccess: "session",
});

export const auth = betterAuth({
  plugins: [
    ...passkeyStack.plugins,
    zeroAccess({
      deploymentMode: "single-instance",
      requireRecoveryExportAck: true,
      // Production: assertAccess via createZeroAccessAssertAccess + requireAccess
      // Optional: a stable root separate from Better Auth sessions.
      // secret: process.env.ZERO_ACCESS_SECRET,
    }),
  ],
});

Lab/dev may omit assertAccess at standard (warning); protected endpoints still deny without a callback. See Quick start.

passkeyGuardPlugin remains an optional explicit identity assertion. Normal compositions omit it; if provided, initialization fails closed unless it is the installed guard object.

There is no child-authority setup. Without secret, zeroAccess() captures Better Auth's resolved secret. With secret, Railman persistent data has its own root lifecycle. The plugin derives non-extractable MAC and storage-ID families and separates every purpose internally.

Client BA plugin

import { zeroAccessClient } from "@railman/auth-zero-access/client";

createAuthClient({ plugins: [zeroAccessClient()] });

Low-level wrap helpers also live under @railman/auth-zero-access/client (initMek, unlockMekWithPrf, …). Prefer createVaultClient for product UX.

Wrap kinds

Next

• Zero-vault
• Recovery
• Use case D
• API