Self-hosting

Run your own AuthenSee auth server, or use the managed instance — same codebase, same API, same SDK compatibility.

What you'll decide: whether to use the managed AuthenSee instance or deploy the auth server yourself. Both run the same codebase and expose the same API — the only difference in your integration is the server URL.

Option 1: managed (default)

Use the hosted instance at api.authensee.com, deployed and managed by Rebellion Systems.

What you get:

Zero infrastructure management
Automatic updates and security patches
SLA-backed uptime
Managed PostgreSQL with automatic backups
Monitoring and alerting

Best for: most providers — you focus on your product, not on running an auth server.

Option 2: self-hosted

Deploy your own instance of the auth server. Same codebase, same API, same SDK compatibility — point serverUrl at your deployment and everything else is identical.

What you need:

PostgreSQL 16+
Node.js 22+ (or Docker, recommended)
Circuit verification keys — at minimum passkey_question_auth; the other circuits are optional at boot but required to support their schemes

Best for: organizations with strict data-residency requirements, compliance needs, or custom infrastructure.

Quick start

# Clone the auth server
git clone https://github.com/rebellion-systems/authnc-auth-server.git
cd authnc-auth-server
 
# Configure
cp .env.example .env
# Edit .env: set DATABASE_URL, JWT_SECRET, CIRCUITS_DIR
 
# Run with Docker Compose
docker compose up -d postgres auth-server
 
# Or run directly
pnpm install
pnpm build
pnpm start

Required environment variables

Variable	Description
`DATABASE_URL`	PostgreSQL connection string
`JWT_SECRET`	Secret for signing internal action tokens (min 32 chars)
`AUTH_RESULT_PRIVATE_JWK` / `AUTH_RESULT_PUBLIC_JWK`	EdDSA (Ed25519) JWK pair for signing auth-result JWTs; the public key is served at `/.well-known/jwks.json`
`CIRCUITS_DIR`	Path to compiled circuit verification-key artifacts
`VK_HASH_PASSKEY_QUESTION_AUTH`	SHA-256 hash of the `passkey_question_auth` verification key — required at boot
`VK_HASH_BEHAVIOR_AUTH_PASSKEY`	Hash of the `behavior_auth_passkey` key — optional; needed for `passkey_and_behavior`
`VK_HASH_PASSKEY_ONLY_AUTH`	Hash of the `passkey_only_auth` key — optional; needed for `passkey_only`
`VK_HASH_AGENT_KEYPAIR_AUTH`	Hash of the `agent_keypair_auth` key — optional; needed for agent personas
`ALLOWED_ORIGINS`	CORS allowed origins (your app domains) — required in production, no wildcard
`PORT`	Server port

Circuit artifacts

The auth server requires compiled circuit verification keys:

git clone https://github.com/rebellion-systems/authnc-circuits.git
cd authnc-circuits
nargo compile --program-dir circuits/noir/passkey_question_auth
nargo compile --program-dir circuits/noir/behavior_auth_passkey
nargo compile --program-dir circuits/noir/passkey_only_auth
nargo compile --program-dir circuits/noir/agent_keypair_auth

Point CIRCUITS_DIR at the compiled output. Only passkey_question_auth is required for the server to boot; the others are loaded (and hash-checked) if present, and are needed only to support their respective schemes.

SDK compatibility

Both deployment options expose the same API. The SDK doesn't know or care which it's talking to — the only difference is serverUrl:

import { createAuthenSeeSdk } from '@rebellion-systems/authensee-sdk';
 
const authensee = createAuthenSeeSdk({
  serverUrl: 'https://auth.yourcompany.com', // or https://api.authensee.com
  apiKey: process.env.AUTHENSEE_SECRET_KEY!,
});

Provider secret keys (sk_) and session tokens (sess_) work identically on both.

Migrating between options

Export your provider configuration (API keys, policies)
Point serverUrl at the new deployment
Users do not re-enroll — their enrolled scheme commitments are portable

Enrolled scheme commitments must be migrated to the new database. Contact Rebellion support for managed → self-hosted migration assistance.

API reference — the API surface your instance exposes
Security model — what your instance stores (and deliberately doesn't)
Hosted pages guide — the flow your users see either way