Passwordless Zero-Trust Gateway

Secure apps with the Zero Auth API

Eliminate passwords. Integrate WebAuthn biometric signatures, dynamic cryptographic key verification, and contextual risk analysis into your backend using a simple developer API.

Get API Credentials Explore Endpoints

Latency: < 35ms
Standard: FIDO2
Sandbox rate: 60 calls/min

Zero Auth Engine

Secure Mode

ALG: RS256

POST /api/v1/auth/verify-assertion HTTP/1.1
Host: console.devsecit.com
Authorization: Bearer DSI_ZA_...
Content-Type: application/json

// Request Payload
{
  "credential_id": "cred_89271ac...",
  "client_data_json": "eyJjaGFsbGVuZ2UiOiI...",
  "signature": "MEUCIQDM8S1b..."
}

Passwordless verificationCryptographic trust validation

Platform overview

Platform Overview & Business Architecture

The Zero Auth API is a developer-focused passwordless authentication engine. It allows developers to replace legacy, vulnerable password authentication models with modern, device-bound cryptographic keys and biometric signatures (such as Face ID, Touch ID, and Windows Hello), using WebAuthn and FIDO2 standards.

By routing authentication requests through the Zero Auth API, your backend applications can verify login attempts without ever receiving, transmitting, or storing password strings. The system uses asymmetrical cryptography: a public key is registered on our secure servers, while the private key remains secure within the user's device TPM (Trusted Platform Module).

This identity platform also implements contextual risk scoring, dynamically evaluating factors such as IP reputation, geographical velocity, and device health to detect and block authorization attempts from stolen tokens or compromised systems.

Capabilities

Identity & Auth Features

Biometric Verification

Integrate WebAuthn/FIDO2 flows. Let users login using local biometric checks (Face ID, fingerprint, Windows Hello).

OAuth2 & OIDC Compliance

Use standard identity protocols, allowing drop-in integration with services like Azure AD, Okta, and Google Workspace.

Contextual MFA Challenges

Dynamically prompt for additional validation steps if risk factors (such as geolocation or device status) change during a session.

Continuous Session Checks

Continuously evaluate trust metrics throughout a session, and instantly revoke tokens if security compliance parameters are breached.

Technical reference

API Reference & Technical Endpoints

The Zero Auth API uses JSON payloads over HTTPS. Below are the request and response structures for validating a cryptographic login assertion.

HTTP Request (POST)VERIFY LOGIN ASSERTION

POST https://console.devsecit.com/api/v1/auth/verify-assertion

Header "Authorization: Bearer YOUR_ZERO_AUTH_TOKEN"

Header "Content-Type: application/json"

Request Payload (Body JSON)

{
  "user_id": "usr_9847120a",
  "credential_id": "cred_f89102c91823abce",
  "authenticator_data": "SZW5hYmxlZF9kZWJ1Z2dlcg==",
  "client_data_json": "eyJjaGFsbGVuZ2UiOiJkM2R2WVhSMWFXNW5...",
  "signature": "3045022100e47d1a2b3c4d8e9f...",
  "risk_context": {
    "ip_address": "198.51.100.1",
    "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)..."
  }
}

Successful Response Payload (200 OK)

{
  "status": "authenticated",
  "token_type": "Bearer",
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIs...",
  "expires_in": 3600,
  "user": {
    "id": "usr_9847120a",
    "email": "developer@devsecit.com"
  },
  "trust_score": 98.4
}

How it works

The Passwordless Cryptographic Handshake

Understanding the registration and validation handshake process is important for successful integration:

Registration Phase
The client triggers `navigator.credentials.create()` on the browser. The user authenticates locally, and the device generates a public-private key pair. The public key is sent to the Zero Auth API.
Login Challenge
When logging in, the server generates a cryptographically signed challenge token.
Client Assertion
The client device signs this challenge using its local private key, generating an assertion payload.
Verification
The Zero Auth API validates the assertion signature using the registered public key, confirming the login attempt.

Security & compliance

Security, Token Vaulting & Enterprise Compliance

The Zero Auth API is built to meet the security requirements of modern enterprises:

Secure Key Vaulting

Public keys and user identifiers are encrypted at rest using AES-256-GCM. Private keys never leave the user's hardware TPM.

FIDO2 & WebAuthn Compliant

Fully compliant with W3C standards, ensuring compatibility across modern operating systems, browsers, and security keys.

Real-time Session Revocation

Monitor active sessions, detect anomalies, and revoke tokens instantly when security parameters are breached.

Detailed Audit Trails

The API logs every token generation, verification, and revocation event for compliance and analysis.

Deployments

Enterprise Use Cases

Secure SSO Gateways

Provide employees and clients with passwordless, single sign-on access across all connected corporate web portals and applications.

High-Security Financial Checkouts

Require FIDO2 biometric authentication for large financial transfers or critical database changes, preventing session hijacking.

Zero-Trust Infrastructure Access

Secure internal SSH tunnels, developer databases, and deployment platforms using biometric authentication.

Measured at the gateway

The numbers the

The figures published on this page: the latency, the cipher, the signature algorithm and the sandbox ceiling.

Average latency: < 35ms
Encryption at rest: AES-256-GCM
Signature algorithm: RS256
Sandbox rate limit: 60 /min

FAQ & Troubleshooting Guide

Frequently asked

Does Zero Auth store user biometric data?

No. Biometric checks are handled locally by the user's device operating system. The API receives only a cryptographic signature verifying that the check passed.

What happens if a user loses their biometric device?

Users can register backup authentication methods (such as hardware FIDO keys or secure recovery codes) to recover account access.

Is the API compatible with older web browsers?

The API is compatible with modern browsers that support WebAuthn. If a browser does not support it, you can configure the system to fall back to secure magic links.

How are rate limits structured for authentication calls?

Standard sandbox accounts support up to 60 calls/minute, while enterprise tiers scale to handle thousands of concurrent authentication events.

Get started

Deploy Passwordless Identity Security

Get your developer credentials, configure WebAuthn registration endpoints, and eliminate password threats today.

Get Started