Self-hosted WebAuthn

Passkeys.
Without a new identity stack.

Shellty Passkey Server adds passkeys to existing applications.

Self-hosted. One Go binary. PostgreSQL.

Download latest releaseView on GitHub

Keep your users, sessions and identity infrastructure where they are.

One binary.
One config file.
One PostgreSQL database.

No Redis. No message broker. No vendor cloud.

Architecture

Fits in.

Your backend keeps the user, session and login logic. Shellty handles passkey registration and authentication.

Shellty Passkey Server architecture: browser or mobile app connects to the existing application backend, which calls Shellty Passkey Server over REST and mTLS; Shellty stores state in PostgreSQL.

No IAM migration. No yet another customer database.

Who it is for

Made for existing systems.

Banks & fintech

Add passkeys inside your existing security boundary.

SaaS & enterprise

Keep your IAM. Add WebAuthn through a small REST API.

Integrators

A compact base you can understand, deploy and extend.

Security

Small by design.

mTLS integration APIMandatory user verificationServer-side ceremony stateApplication-specific RP and Origin validationPostgreSQL persistenceExplicit SQL migrationsNo outbound telemetrySmall dependency tree

Less systems to operate. Less code to trust.

Adoption

Passkeys are already here.

Google, Meta and PayPal use passkeys for account authentication. Visa and Mastercard are bringing FIDO-based passkeys into payments.

Google ↗ Meta ↗ PayPal ↗ Visa ↗ Mastercard ↗

Shellty brings the same WebAuthn foundation to applications that need to run it themselves.

Financial services

Built with financial services in mind.

Banks already have IAM, customer databases with CRM ID, CIF — you name it — and session infrastructure. Shellty fits into your landscape.

Self-hosted and on-prem friendly
Auditable architecture and dependencies
Ready to grow toward transaction authentication
Visa Payment Passkey, Mastercard payment integrations and payment-scheme certification are not part of the current open-source release.
Operations

From download to running.

Create DB
Write config.json
Start passkey-server
Call the API
./passkey-server \
  --config=config.json \
  --database-dsn="$DATABASE_DSN" \
  --tls-cert=server.crt \
  --tls-key=server.key \
  --client-ca=client-ca.crt
Read the docs
Releases

Ready to run.

Download a release for your platform. Source is there when you want it.

Download latest releaseBuild from source
Commercial support

Need more than the binary?

We help teams integrate Shellty into real systems.

Functional enhancement Implementation projects Customer support
Discuss your implementation

Open source.
Commercial help when you need it.

Review the code. Run it yourself. Bring us in when the integration gets specific.

GitHubLicense