entropy-auth

released

Rust Authentication Crate

One audited authentication core powering every Entropy app.

Overview

entropy-auth is the Rust crate that every one of our backends authenticates through: passwords (Argon2id), sessions, passkeys/WebAuthn, TOTP MFA, OAuth 2.0 / OIDC, SAML, JWTs, API keys, and breach checking. Centralizing it means a single place to fix a bug, harden a vector, or pass an audit. It's secret-safe by construction: constant-time comparisons, zeroizing wrappers, and no secrets in debug output.

Ships as

What it does

Argon2id password hashing and session management
Passkeys / WebAuthn (with PRF) always on
TOTP MFA, recovery codes, HIBP breach checking
OAuth 2.0 + PKCE, OpenID Connect, SAML 2.0
JWT (symmetric and asymmetric), API keys, HMAC request signing
Crypto implemented to spec against pinned test vectors

entropy-auth is open source

Read it, file an issue, or send a patch.

View the sourceDocs — coming soonContribute