@avokwalletjs/federation-server

Backend auth node for Avok federated connections: keyless OIDC, the authorize ceremony, the ROR /.well-known/webauthn document, and deployment + client-registration config. A direct (frontend-only) app never runs this; only a network operator who wants other apps to federate to its identity does.

npm install @avokwalletjs/federation-server

import { createAuthServer, parseDeploymentConfig, parseClientRegistrations } from "@avokwalletjs/federation-server";

const server = await createAuthServer({
  deployment: parseDeploymentConfig(process.env),
  clients: parseClientRegistrations(process.env.AVOK_OIDC_CLIENTS_JSON),
});
server.listen(); // defaults to AVOK_AUTH_PORT or 3002

createAuthServer returns an AuthServer with handle(req, res) for mounting in an existing Node http server, or listen(port?) for the standalone path. To also sponsor gas, compose it with @avokwalletjs/paymaster in the same process by routing requests to each server's handle.

This package signs id_tokens and runs the passkey ceremony. It must never receive user private keys, raw PRF output, or decrypted signing material.

Status

Unaudited; see the repository SECURITY.md.

License

MIT.