What is Flowsta?

Start with the one idea everything else follows from:

A Flowsta account lives on the user's device, not on a server. Their 24-word recovery phrase deterministically derives their keys. The Flowsta Vault app holds those keys and a personal Holochain node. There is no password - anywhere. When someone signs in to your app, their Vault signs a challenge and they approve it. Your app asks; the user answers. No one in between - not even Flowsta.

On top of that identity, Flowsta gives developers three building blocks:

Sovereign login - OAuth 2.0 + PKCE for web apps, local Vault IPC for desktop apps. Either way, the user approves with keys only they hold.
Sign It - cryptographic file signing and verification, approved per-signature in the user's Vault, verifiable by anyone.
Real-time webhooks - HMAC-signed events so your server reacts to user actions the moment they happen.

Integrate one. Integrate all three. They share one identity and one mental model.

The Problem

Traditional authentication services (Auth0, Firebase Auth, AWS Cognito) put a company between your users and your app:

Single point of failure - If their servers go down, so does your login
Data breaches - Centralized credential stores are honeypots
Censorship risk - A central authority can shut accounts down
Vendor lock-in - Your user relationships are trapped in their system

The Flowsta Difference

	Traditional Auth	Flowsta
Where identity lives	Their database	The user's device
Credential on a server	Password hash	Nothing - no password exists
Identity standard	Proprietary user IDs	W3C DIDs (permanent - they never change)
Who approves a sign-in	The provider's session logic	The user, in their Vault
Privacy	Provider can read user data	Zero-knowledge - private records never leave the device
Single point of failure	Yes	No - distributed network with community-run nodes

Integration Paths

Four ready-to-start integration patterns. Pick your login path first, then layer on what you need:

Path 1: Web Apps - OAuth SSO

Add "Sign in with Flowsta" to any website or web app. Standard OAuth 2.0 with PKCE - no client secrets needed. Behind the redirect, the user approves the sign-in with their Vault; your integration is plain OAuth.

How it works:

Your app redirects users to Flowsta's login page
The user approves the sign-in with their Flowsta Vault (no password exists)
Flowsta redirects back with an authorization code
Your app exchanges the code for an access token (PKCE)
You receive user profile data - a stable sub, display name, DID, and more

About email

Flowsta stores no email for the account - the email scope asks the user to share their address at the consent screen. If they do, you receive email and email_verified (verified addresses only); if they revoke your app, the shared copy is deleted. Design your app to work without one.

typescript

import { FlowstaAuth } from '@flowsta/auth';

const auth = new FlowstaAuth({
  clientId: 'your_client_id',
  redirectUri: 'https://yourapp.com/auth/callback'
});

auth.login(); // Redirects to login.flowsta.com
const user = await auth.handleCallback();

Get started with Web Auth →

Path 2: Desktop Holochain Apps - Identity Linking

Let users prove their Flowsta identity on your Holochain app's DHT. Your app's agent key gets linked to the user's Flowsta identity through cryptographic attestations - no shared DNA required.

How it works:

Your app checks if Flowsta Vault is running locally
Your app sends an identity linking request via IPC
The user approves the link in Flowsta Vault
Vault signs a payload with its agent key
Your app commits an IsSamePersonEntry attestation to your DHT

typescript

import { linkFlowstaIdentity } from '@flowsta/holochain';

const result = await linkFlowstaIdentity({
  appName: 'YourApp',
  clientId: 'your_client_id',
  localAgentPubKey: myAgentKey,
});
// Your app commits result.payload to your DHT via a zome call -
// see the Agent Linking guide for the create_external_link recipe.

Get started with Holochain Apps →

Desktop Apps

Building a desktop app? Authenticate through Flowsta Vault's local IPC with @flowsta/holochain - no browser redirect, no credentials in your app. Learn more →

Path 3: Document Signing - Sign It

Let users cryptographically sign files through your app. Prove authorship, declare content rights, and verify signatures - with each signature approved by the user in their Vault, signed with keys that never leave their device.

How it works:

Your app hashes a file client-side (SHA-256) - the file itself is never uploaded
The user approves the signature in their Flowsta Vault
Signature + metadata publish to Flowsta's tamper-proof network, built on Holochain
Anyone can verify by checking the file hash - verification is free and unlimited

typescript

import { FlowstaAuth, hashFile } from '@flowsta/auth';

const flowsta = new FlowstaAuth({
  clientId: 'your_client_id',
  redirectUri: 'https://yourapp.com/callback',
  scopes: ['openid', 'display_name', 'sign'],
});

const hash = await hashFile(file);
const result = await flowsta.signFile({
  fileHash: hash,
  intent: 'Authorship',
});

App-initiated signatures draw from your org's monthly sponsored signing pool - your users never spend their personal quota using your product. How signing quotas work →

Get started with Sign It →

Path 4: Real-Time Webhooks (paid tiers)

Subscribe your server to events from your OAuth app's users - sign.created, sign.revoked, oauth.authorized, oauth.token.revoked, user.profile.updated. Every payload is HMAC-signed.

Webhooks are available on Spark, Pro, and Enterprise tiers. They layer on top of the OAuth path - no new app type to register.

bash

curl -X POST https://auth-api.flowsta.com/api/v1/webhooks \
  -H "Authorization: Bearer <your-app-jwt>" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://yourapp.com/hooks/flowsta",
    "events": ["sign.created", "sign.revoked"]
  }'

The response includes the webhook secret used to verify every delivery. Store it - it's only returned on create.

Get started with Webhooks →

Key Features

Zero-Knowledge Privacy

Flowsta physically cannot access your users' private data - because it never has it.

Keys derive from the recovery phrase on the user's device. Private records are sealed locally in the Vault and never leave it. The server stores only an email hash and lookup metadata - no password hash (no password exists), no keys, nothing to breach. How this works →

W3C Decentralized Identifiers (DIDs)

Every user gets a globally unique, cryptographically verifiable identity:

Format: did:flowsta:uhCAk... (based on Ed25519 public key)
Permanent: the DID never changes for the life of the account - across devices, restores, and upgrades
Self-sovereign: Users own their DID, not Flowsta
Portable: Works across any DID-compatible system

Cross-Platform Identity

One Flowsta account works across web and desktop:

Sign in to any partner website with OAuth SSO
Link identity to any Holochain app through Vault
Same DID and cryptographic identity everywhere

Secure by Default

Ed25519 cryptography - Industry-standard public key cryptography
BIP39 recovery phrases - 24-word mnemonics like hardware wallets; the phrase restores identity on any device
OAuth 2.0 + PKCE - No client secrets needed for web apps
No passwords - Nothing to phish, leak, stuff, or reset

Architecture

Flowsta uses three Holochain DNAs, plus device-local sealed storage:

Layer	Purpose	Where it lives
Identity DNA (Public)	Public profile	DID, agent public key, agent links - on the shared network
Signing DNA (Public)	Document signing	File signatures, content rights, perceptual hashes - on the shared network
Sealed private records	Sensitive data	Profile details, activity, app records - encrypted on the user's device only; they do not gossip

Zero-Knowledge Guarantee

Private records are sealed with device-held keys and never leave the user's Vault. Public data (profile, signatures) is verifiable by anyone on Flowsta's tamper-proof network, built on Holochain.

Learn more about Holochain Architecture →

What's Next?

Quick Start → Register Your App Web Auth Guide Vault Guide Sign It Guide Webhooks Guide

Questions?

Discord: Join our community
Support: Find out about Flowsta support options
GitHub: github.com/WeAreFlowsta

What is Flowsta? ​

The Problem ​

The Flowsta Difference ​

Integration Paths ​

Path 1: Web Apps - OAuth SSO ​

Path 2: Desktop Holochain Apps - Identity Linking ​

Path 3: Document Signing - Sign It ​

Path 4: Real-Time Webhooks (paid tiers) ​

Key Features ​

Zero-Knowledge Privacy ​

W3C Decentralized Identifiers (DIDs) ​

Cross-Platform Identity ​

Secure by Default ​

Architecture ​

What's Next? ​

Questions? ​

What is Flowsta?

The Problem

The Flowsta Difference

Integration Paths

Path 1: Web Apps - OAuth SSO

Path 2: Desktop Holochain Apps - Identity Linking

Path 3: Document Signing - Sign It

Path 4: Real-Time Webhooks (paid tiers)

Key Features

Zero-Knowledge Privacy

W3C Decentralized Identifiers (DIDs)

Cross-Platform Identity

Secure by Default

Architecture

What's Next?

Questions?