render: dynamic · session none

Sign in without a password.

Auth is the layer teams hand to a vendor first. Here it is three files we own and no library, mounted in two lines, with no password table to leak.

How it is wired

One handler, two lines

The handler speaks plain Request → Response, so Waku mounts it like any other file under src/pages/_api/. The browser hands over the public key and WebCrypto checks every signature. Keys and sessions sit in a SQLite file through node:sqlite, which ships inside Node.

// src/pages/_api/api/auth/[...route].ts
import { auth } from '../../../../lib/auth';
export const POST = (request: Request) => auth.handleAuth(request);

One session read per request

React's cache() verifies the cookie once, however many components ask. Sign-out is a server function with the same guard as every other one: no session, nothing to do.

// src/lib/session.ts
export const getSession = cache(() => auth.readSession(requestHeaders()));

this page used to say auth was not wired. then it ran on a passkey package of ours that wrapped three libraries. now the platform does the work. the account you make here is a throwaway: no email asked, nothing worth stealing

home