Skip to content
Open source ยท MIT

No auth server in the request path

valiss is offline tenant authentication for services. Every token verifies against one pinned Ed25519 public key: no introspection endpoint, no session store, and issuing credentials never touches production.

Get started Read the docs
go get valiss.dev/valiss
// Issue: the operator signs the account, the account signs the user.
accountToken, _ := valiss.IssueAccount(operator, accountPub,
    valiss.WithName("acme"), valiss.WithTTL(time.Hour))
userToken, _ := valiss.IssueUser(account, userPub,
    valiss.WithName("alice"), valiss.WithTTL(time.Hour))

// Verify offline: the operator public key and the allowlist, no network call.
acct, _ := valiss.VerifyAccount(accountToken, operatorPub)
verifier := valiss.NewVerifier(operatorPub, valiss.NewStaticAllowlist(acct.ID))

What you get

Offline
verification

Tokens verify against one pinned operator public key. No introspection endpoint, no session store, and no network call on the request path.

Proof of
possession

By default a token authorizes nothing on its own. Each request is signed by the subject’s own key, so a token captured off the wire is inert.

Fail-closed
allowlist

An account token is trusted only if its id is on the list you deposited. Revocation is removal, and it cuts off every user beneath the account.

Typed
extension grants

Authorization rides signed, typed claims. The http and grpc transports enforce them fail-closed, and you can define your own domain extensions.

Epoch
rotation

Publish a signed operator token at a new epoch and re-mint. Every token from an earlier epoch is rejected cryptographically, with no allowlist edits.

Go, Python,
TypeScript

Go is the reference implementation. Python is a full client at parity. TypeScript ships the sign and verify primitives only, with no transport adapter yet. All speak one wire spec.