Ave

Ave is an open-source identity provider for apps that need to be secure and end-to-end encrypted. Users sign in with passkeys over standard OAuth 2.0 and OpenID Connect, and apps can receive a per-user encryption key that is unwrapped on the user's device and delivered in the callback URL fragment. Ave's servers only ever store those keys encrypted by the user's master key.

Apps own their workspaces, membership, billing, and authorization. Ave supplies the verified identity and the keys that identity grants to the app.

Repository

Package	Purpose
ave-server	Hono API on Cloudflare Workers, with D1, R2, Queues, and Durable Objects
ave-web	SvelteKit frontend for aveid.net and devs.aveid.net
ave-docs	Public documentation at docs.aveid.net
sdks/ave-sdk	TypeScript SDK with browser, server, Expo, Svelte, and Convex integrations
sdks/ave-embed	Browser embed for sign-in

Developer teams in devs.aveid.net own OAuth apps and their credentials. Every member can manage the team's apps, members, and profile, and a team always keeps at least one member.

Development

Install Bun and install dependencies once from the repository root:

bun install --frozen-lockfile

Copy ave-server/.dev.vars.example to ave-server/.dev.vars and configure local signing keys and secrets. Use local values rather than production credentials. R2 and email use Worker bindings.

cd ave-server
bun run db:migrate:local
cd ..
bun run dev:api

In another terminal:

bun run dev:web

Configure the frontend's local environment when using the local API:

VITE_API_URL="http://localhost:3000"
VITE_WS_URL="ws://localhost:3000/ws"

The local frontend serves the product at / and the developer portal at /devs. API development uses port 3000.

Validation

From the repository root:

bun run check
bun run build

Package scripts remain available from their directories. ave-server generates its passkey module during checks and Worker builds. SDK builds replace their output directory so removed exports cannot survive in published packages.

The API entrypoint is ave-server/src/index.ts. HTTP composition, request metadata, origins, and the login channel live in src/runtime; database tables are grouped under src/db/schema; API routes and their domain helpers live under src/routes and src/lib.

Cloudflare deployment

The API and frontend each have a wrangler.jsonc. Cloudflare builds should install from the repository root with bun install --frozen-lockfile, then run the relevant package's deploy script.

The API uses D1 read sessions and bookmarks, R2 uploads, Cloudflare email, login-approval and rate-limit Durable Objects, background event queues, Analytics Engine, and Smart Placement. Passkey operations load a separately bundled module within the API Worker. Push delivery runs in the same Worker.

For a new account, create the queues before deploying:

cd ave-server
bunx wrangler queues create ave-background-events
bunx wrangler queues create ave-background-events-dlq
bun run db:migrate:remote
bun run deploy
cd ../ave-web
bun run deploy

For an existing deployment, inspect pending migrations before applying them. Back up D1 before destructive schema changes. The developer membership migration must precede the API deployment; the subsequent retirement migration is applied after the API has switched to the new tables. See deployment notes.

Keep D1 read replication enabled. Clients send D1 bookmarks to preserve read-your-writes consistency.

SDK publication

.github/workflows/publish-npm.yml publishes sdks/ave-sdk or sdks/ave-embed through npm trusted publishing. Configure each npm package's trusted publisher for this repository and workflow, then run the workflow from a branch with the package path, requested version, and access level. It updates the package version and root Bun lockfile, builds, commits the version bump, and publishes with provenance.

Packages must retain repository.url pointing to https://github.com/Lantharos/Ave so npm can validate provenance. No npm token is required.

Documentation

Public guides cover end-to-end encryption, OAuth and PKCE, confidential clients, sessions, app authorization, and framework integrations. Update ave-docs when changing public behavior or SDK contracts.

Read CONTRIBUTING.md for contribution guidance and SECURITY.md for private vulnerability reporting.