Zero-Knowledge Authentication

Secure Authentication

Learn how ZKAuth uses zero-knowledge proofs to provide tenant-bound zero-knowledge authentication.

How ZKAuth Works

Understanding the core concepts behind zero-knowledge authentication

Zero-Knowledge Proofs

Mathematical proofs that verify knowledge without revealing the knowledge itself

ZK proofs allow users to prove they know a password without ever sending the password to the server.

Cryptographic Security

Modern cryptographic controls with Groth16 verification, Argon2id, and replay protection

All authentication data is encrypted using state-of-the-art cryptographic algorithms.

Privacy by Design

User data is never stored or transmitted in plain text

Server compromise does not reveal plaintext passwords from stored commitments, but operational secrets still require normal protection.

Passkey Integration

Support for WebAuthn passkey ceremonies when RP ID and origin are configured

Use WebAuthn as a step-up or passkey path alongside ZK proof verification.

Authentication Flow

Step-by-step process of how ZKAuth authenticates users securely

Complete Authentication Flow

Registration and authentication with ZK proof generation and verification

javascript
javascript
// 1. User Registration with ZK Proof (SDK handles proof generation)
const registerResult = await zkauth.register({
  email: 'user@example.com',
  password: 'secure-password',
  deviceInfo: { deviceName: 'Chrome on Mac', deviceType: 'desktop' }
});

// 2. Authentication with ZK Verification
const session = await zkauth.login({
  email: 'user@example.com',
  password: 'secure-password',
  deviceInfo: { deviceName: 'Chrome on Mac', deviceType: 'desktop' }
});

// 3. Session Management
if (session.success) {
  console.log('ZK Proof verified successfully');
  console.log('Session token:', session.data?.session?.token);
}

Advanced Features

Enterprise-grade authentication features for production applications

Advanced Authentication Options

Multi-factor authentication, device trust, and custom proof types

javascript
javascript
// Advanced Authentication with Custom Proofs
const customAuth = await zkauth.authenticate({
  email: 'user@example.com',
  password: 'secure-password',
  options: {
    proofType: 'groth16',
    proofComplexity: 'high',
    passkeyCredential: credentialResponse,
    deviceTrust: true,
    locationVerification: true
  }
});

// Multi-factor Authentication
const mfaResult = await zkauth.verifyMFA({
  sessionId: session.id,
  mfaCode: '123456',
  mfaType: 'totp'
});

// Session Validation
const isValid = await zkauth.validateSession({
  token: session.token,
  proofHash: session.proofHash,
  deviceId: deviceId
});

Security Features

Built-in security measures to protect your applications

Brute Force Protection

Rate limiting and progressive delays prevent automated attacks

javascript
// Automatic rate limiting
const auth = await zkauth.signIn(email, password);
// If failed attempts detected, progressive delays are applied

Device Fingerprinting

Track and verify trusted devices for enhanced security

javascript
// Device verification
const device = await zkauth.registerDevice({
  deviceId: generateDeviceId(),
  deviceInfo: getDeviceInfo(),
  userAgent: navigator.userAgent
});

Session Management

Secure session tokens with automatic expiration and rotation

javascript
// Session configuration
const session = await zkauth.createSession({
  userId: user.id,
  expiresIn: '24h',
  maxDevices: 5,
  requireReauth: true
});

Audit Logging

Comprehensive audit trails for compliance and security monitoring

javascript
// Audit log entry
const auditLog = await zkauth.logEvent({
  event: 'user_login',
  userId: user.id,
  ipAddress: clientIP,
  userAgent: userAgent,
  success: true
});

What's Next?

Continue learning about ZKAuth security and implementation

Security

Security best practices and compliance

SDK Reference

Complete API documentation

Examples

Real-world integration examples

Ready to Secure?

Start building secure applications with ZKAuth today.