Show HN: Open Passkey – open-source passkey auth with free "backendless" host

Posted by connorpeters 2 days ago

Counter10Comment2OpenOriginal

I, like Andrej Karpathy, became super frustrated by how annoying it was to deploy projects that were previously an absolute joy to make with Claude Code. That is why I made open-passkey, an MIT licensed passkey repo with support for 33 languages and frameworks (examples included) that makes adding simple secure auth to a project easy.

We are also releasing gateway (https://gateway.locke.id) a "backendless" hosted auth server that frontend apps can consume for free so that you can ship a React or Angular app using a CDN like Netlify without needing to configure a server at all. We are willing to freely share the resources of an AWS t.large instance which should easily support millions of accounts & sessions. This decision was made to improve our velocity when it comes to shipping small apps (it should go without saying that this is not designed for large apps).

Open-passkey prioritizes post-quantum algorithms, though they are not supported by browsers yet. On top of Gateway, we also built a simple end-to-end encrypted key value store modeled after localStorage. A simple setItem() and getItem() API that uses PRF with passkeys to store encrypted values on gateway with zero config. This, again, was made to improve our velocity to securely add API keys and stuff to frontend apps without needing to pay for a server to host. Obviously gateway is completely optional and exporting out your users public keys is supported with rp_id verification via domain TXT records.

Comments

Comment by anatoli_k 1 day ago

A shared t.large running free for everyone is generous, but I've seen a lot of "free hosted" services quietly disappear once costs stop feeling small. What is the plan if the hosting gets too expensive to keep free, especially once outbound traffic from AWS starts adding up? Is there a documented migration path so people who build on gateway will not get stuck?

Comment by connorpeters 1 day ago

Good question, we have the export functionality so people can move off easily, but I did not take into account a way to contact domain owners to let them know if we are turning off the server. We have enough AWS credits to run gateway for free (to us) for ~20 months as-is, but I suppose we should make a clearly documented plan for sunsetting the service if we ever decide to do that. Great point, and is something I will mull on.

Comment by aristech 2 days ago

[dead]