Secure apps with Zero Auth API
Eliminate passwords. Integrate WebAuthn biometric signatures, dynamic cryptographic key verification, and contextual risk analysis into your backend using a simple developer API.
Zero Auth Engine
● Secure ModePOST /api/v1/auth/verify-assertion HTTP/1.1
Host: console.devsecit.com
Authorization: Bearer DSI_ZA_...
Content-Type: application/json
// Request Payload
{
"credential_id": "cred_89271ac...",
"client_data_json": "eyJjaGFsbGVuZ2UiOiI...",
"signature": "MEUCIQDM8S1b..."
}
1. Platform Overview & Business Architecture
The Zero Auth API is a developer-focused passwordless authentication engine. It allows developers to replace legacy, vulnerable password authentication models with modern, device-bound cryptographic keys and biometric signatures (such as Face ID, Touch ID, and Windows Hello), using WebAuthn and FIDO2 standards.
By routing authentication requests through the Zero Auth API, your backend applications can verify login attempts without ever receiving, transmitting, or storing password strings. The system uses asymmetrical cryptography: a public key is registered on our secure servers, while the private key remains secure within the user's device TPM (Trusted Platform Module).
This identity platform also implements contextual risk scoring, dynamically evaluating factors such as IP reputation, geographical velocity, and device health to detect and block authorization attempts from stolen tokens or compromised systems.
2. Identity & Auth Features
Biometric Verification
Integrate WebAuthn/FIDO2 flows. Let users login using local biometric checks (Face ID, fingerprint, Windows Hello).
OAuth2 & OIDC Compliance
Use standard identity protocols, allowing drop-in integration with services like Azure AD, Okta, and Google Workspace.
Contextual MFA Challenges
Dynamically prompt for additional validation steps if risk factors (such as geolocation or device status) change during a session.
Continuous Session Checks
Continuously evaluate trust metrics throughout a session, and instantly revoke tokens if security compliance parameters are breached.
3. API Reference & Technical Endpoints
The Zero Auth API uses JSON payloads over HTTPS. Below are the request and response structures for validating a cryptographic login assertion.
POST https://console.devsecit.com/api/v1/auth/verify-assertion
Header "Authorization: Bearer YOUR_ZERO_AUTH_TOKEN"
Header "Content-Type: application/json"
{
"user_id": "usr_9847120a",
"credential_id": "cred_f89102c91823abce",
"authenticator_data": "SZW5hYmxlZF9kZWJ1Z2dlcg==",
"client_data_json": "eyJjaGFsbGVuZ2UiOiJkM2R2WVhSMWFXNW5...",
"signature": "3045022100e47d1a2b3c4d8e9f...",
"risk_context": {
"ip_address": "198.51.100.1",
"user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)..."
}
}{
"status": "authenticated",
"token_type": "Bearer",
"access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIs...",
"expires_in": 3600,
"user": {
"id": "usr_9847120a",
"email": "developer@devsecit.com"
},
"trust_score": 98.4
}4. The Passwordless Cryptographic Handshake
Understanding the registration and validation handshake process is important for successful integration:
How it works:
- Registration Phase: The client triggers `navigator.credentials.create()` on the browser. The user authenticates locally, and the device generates a public-private key pair. The public key is sent to the Zero Auth API.
- Login Challenge: When logging in, the server generates a cryptographically signed challenge token.
- Client Assertion: The client device signs this challenge using its local private key, generating an assertion payload.
- Verification: The Zero Auth API validates the assertion signature using the registered public key, confirming the login attempt.
5. Security, Token Vaulting & Enterprise Compliance
The Zero Auth API is built to meet the security requirements of modern enterprises:
- Secure Key Vaulting: Public keys and user identifiers are encrypted at rest using AES-256-GCM. Private keys never leave the user's hardware TPM.
- FIDO2 & WebAuthn Compliant: Fully compliant with W3C standards, ensuring compatibility across modern operating systems, browsers, and security keys.
- Real-time Session Revocation: Monitor active sessions, detect anomalies, and revoke tokens instantly when security parameters are breached.
- Detailed Audit Trails: The API logs every token generation, verification, and revocation event for compliance and analysis.
6. Enterprise Use Cases
Secure SSO Gateways
Provide employees and clients with passwordless, single sign-on access across all connected corporate web portals and applications.
High-Security Financial Checkouts
Require FIDO2 biometric authentication for large financial transfers or critical database changes, preventing session hijacking.
Zero-Trust Infrastructure Access
Secure internal SSH tunnels, developer databases, and deployment platforms using biometric authentication.
7. FAQ & Troubleshooting Guide
Q: Does Zero Auth store user biometric data?
A: No. Biometric checks are handled locally by the user's device operating system. The API receives only a cryptographic signature verifying that the check passed.
Q: What happens if a user loses their biometric device?
A: Users can register backup authentication methods (such as hardware FIDO keys or secure recovery codes) to recover account access.
Q: Is the API compatible with older web browsers?
A: The API is compatible with modern browsers that support WebAuthn. If a browser does not support it, you can configure the system to fall back to secure magic links.
Q: How are rate limits structured for authentication calls?
A: Standard sandbox accounts support up to 60 calls/minute, while enterprise tiers scale to handle thousands of concurrent authentication events.
API Documentation
Zero Auth API Platform
Configure Identity Gateway
Deploy Passwordless Identity Security
Get your developer credentials, configure WebAuthn registration endpoints, and eliminate password threats today.