Skip to main content

Fast. Single Sign-On. Universal.

Why use Byte Fast Auth?​

To find out if Byte Fast Auth is something you'd like to add to your website, consider:

Use Byte FAST if:

  • ✅ You want to offer users a fast way to login
  • ✅ You want biometric security
  • ✅ You do not want users having to enter one time pin codes (OTP) all the time
  • ✅ You want users to have a backup of their non-custodial authenticator keys
  • ✅ You do not want to be held hostage by Facebook/Apple/Google and their ever-changing Auth schemes
  • ✅ You want your customers/users in charge of their data
  • ✅ You want your customers/users to bring a crypto & fiat wallet to your website for secure purchasing
  • ✅ You want a simple protocol that just works based on open internet standards

Just scan and be logged in!

  • ❌ No need for password and username input
  • ❌ No need for storing passwords locally or in a browser
  • ❌ No need to memorize passwords
  • ❌ No need to memorize usernames
  • ❌ No need to search for OTP codes
  • ❌ No need to enter ever changing OTP pins
  • ❌ No need to type anything

Features​

ByteWallet's FAST Authentication is built with high attention to user's and developer needs.

  • ₿ Built with 💚 and Bitcoin:
    • Using famous bitcoin-js and ECDSA standards we build on decades of public / private key cryptography
    • Gain full control of your authentication across various domains and websites by simply using your non-custodial wallet
  • Universal:
    • 🌍 Any domain is instantly able to onboard with ByteWallet FAST - no need for API key sharing or clumsy frequent updating on third party gatekeeping provider sites.
    • 💾 Built on open source technology and a transparent methodology. Easy to implement even for webframeworks and programming languages not covered in our code snippets.
  • ✂️ Developer experience:
    • Easy to understand code snippets
    • Minimalistic transparent code
    • Maximum of flexibility and customization options
    • ECDSA and Digital Signature Standards based
    • Fast implementation with minimal efforts

ByteWallet's FAST Authentication is accessible to all your users, and lightning-fast.

  • ⚡️ Lightning-fast. Just requires a QR-code scan and the login is automatic. No need for password and username input. No need for storing passwords locally or in a browser. No need to memorize passwords. No need to memorize usernames. No need to open Authy or Google Authenticator or to hunt down your Authy 2FA code. No need to enter ever changing OTP pins. No need to type anything. Just scan and be logged in! Biometrically safe. Fast. And secure.
  • 🦖 Accessible. No licensing required. ByteWallet download is completely free. ByteWallet is a non-custodial wallet. No vendor lock-in.
info

We are using a deterministically derived BTC address (or public key - whichever you actually want to use) in place of a username and the corresponding private key instead of a password. Biometrics and device safety as well as key management and backup stragies take care of the private key. The deterministic derivation automatically generates unique public keys ("usernames") for different domains.

Design principles​

  • Little to learn. The ByteWallet Fast login button is one click away. Users open the app, click one button and scan. Your website lets them in seconds later.
  • Intuitive. The UX is similar to Telegram or Whatsapp sync. It's intuitive and fast. Your users will love it.
  • Plain architecture. No arcane technologies are being used. Byte Auth's standards are the Internet and Bitcoin cryptography standards used world-wide in millions of transactions.
  • Plain code samples. Our basic architecture makes implementing Byte Auth a breeze. With just a couple of functions added to your webframework of choice, you can offer your users a better experience.
  • No vendor lock-in. Client and server side code remains in your own possession. No IP or binary executable dependency or lock-in. Even ByteWallet's implementation is simple and replicable. We offer ByteWallet as your go-to choice of a wallet, but you don't have to use it as your user's key.

We believe that, as developers, knowing how a system works helps us become better at using it. Hence we're dedicating effort to explaining the architecture and various components of Byte Fast Auth with the hope that developers reading it will be able to implement and tailor it to their own needs quickly.

Overview​

So how does it all work? Let's start with a basic overview over the Byte Fast Auth process flow:

Client Diagram

  • Website | Login Page → with QR Code to be scanned
  • Website | Login Page → QR Code refreshes every 30 seconds
  • User | ByteWallet iOS/Android App → scans QR Code and app generates payload internally.
  • User | ByteWallet iOS/Android App → sends digitally signed payload to Website's webhook URL.
  • Website | Webhook → receives digitally signed ByteWallet request and authenticates user
  • Website | Login Page → redirects authenticated user to their dashboard/account page

The Process​

Let's look at this process in more detail. From a developer perspective all of the website parts are documented with code snippets which should make it easy to implement the Byte Fast Auth sign-on functionality.

What do we have to implement?​

- A server-side function for generating a QR code of the webhook URL.
- The webhook URL points back to our website and includes a session ID and a challenge phrase.
- This webhook-url string with parameters has to be displayed in the login page as a QR code.
- Using any open source javascript library (we have a suggestion) generates a QR code to scan.
- (Our User needs ByteWallet to scan our QR code) 
- On scanning, the app digitally signs the webhook URL and parameters.
- The app POSTS to the webhook URL the digitally signed payload.
- The webhook function then verifies the challenge (to make sure the request is recent) 
- The webhook function then verifies the digital signature
- The webhook function then authenticates the user
- The login page checks the session's login status
- The login page attempts a redirect to the user's restricted page (dashboard/account page etc) 
- The restricted area checks the session, identifies the user as authenticated and grants access

No worries! We have code snippets for the entire process. Let's get started!