An alternative passkey gateway for Nostr. Decentralize your key management across multiple providers. No single point of failure. Works with all authenticators.
Your passkey-encrypted keys live on Nostr relays. The gateways just provide the WebAuthn rpId — and now there are two.
kind:31777 event on your relays.
nostkey.org is a fully compatible keytr gateway. Same protocol, same encryption, different domain.
Create passkeys on both keytr.org and nostkey.org for redundancy. Each produces an independent credential.
Each passkey uses PRF — a hardware-bound secret that never leaves the authenticator — to derive an AES key via HKDF-SHA256. Your nsec is encrypted separately for each credential. Modern password managers and platform authenticators support PRF; if one doesn't, setup fails cleanly rather than falling back to a weaker mode.
Each encrypted blob is published as a separate kind:31777 event. One tags rp: keytr.org, the other tags rp: nostkey.org.
On a new device, authenticate with whichever gateway is available. Cloudflare down? Use nostkey.org. GitHub down? Use keytr.org.
Same encryption. Different infrastructure. True redundancy.
/.well-known/webauthn endpoint and nothing else.Identical cryptography to keytr. Decentralization adds resilience, not complexity.
Both gateways support the same Related Origin Requests spec. Any compatible client works with either.
// Register passkey against keytr.org (PRF)
const { eventTemplate, nsecBytes, npub } = await setup({
userName, userDisplayName, rpId: "keytr.org", rpName: "keytr"
})
// Register a backup passkey against nostkey.org (Hostinger)
// for the same nsec — one extra biometric prompt
const backup = await addBackupGateway(nsecBytes, {
userName, userDisplayName, rpId: "nostkey.org", rpName: "keytr"
})
// Each credential produces a separate kind:31777 event (v=1, PRF)
// Lose access to one gateway? The other still works.Three gateways are better than two. All you need is a domain and one file.
{
"origins": [
"https://nostkey.org",
"https://client-a.com",
"https://client-b.com"
]
}Clients listed in your origins can register passkeys under your domain's rpId. The browser verifies authorization automatically via the Related Origin Requests spec.
Same event format as keytr. Fully compatible kind:31777 parameterized replaceable events.
{
"kind": 31777,
"content": "<base64 encrypted 93-byte blob>",
"tags": [
["d", "<credential-id-base64url>"],
["rp", "nostkey.org"],
["algo", "aes-256-gcm"],
["kdf", "hkdf-sha256"],
["v", "1"],
["transports", "internal", "hybrid"],
["client", "<client-name>"]
]
}The only difference from a keytr.org event is the rp tag. Each gateway's passkey derives its own encryption key via PRF, tagged v=1. (v=3 is a reserved legacy value from the withdrawn KiH mode and is never emitted by new events.) Clients query for events matching the gateway they're authenticating against. transports and client tags are optional.
Use nostkey.org as an rpId in your Nostr client. Same keytr library, different gateway.
npm install @sovit.xyz/keytrimport { setup, discover, publishKeytrEvent } from '@sovit.xyz/keytr'
import { finalizeEvent } from 'nostr-tools/pure'
// Setup with nostkey.org gateway (PRF only)
const { eventTemplate, nsecBytes, npub }
= await setup({ userName: 'alice', userDisplayName: 'Alice', rpId: 'nostkey.org', rpName: 'keytr' })
// Sign & publish the kind:31777 event to your relays
const signed = finalizeEvent(eventTemplate, nsecBytes)
await publishKeytrEvent(signed, relays)
// Discoverable login on a new device: one biometric tap (PRF)
const { nsecBytes, npub, pubkey } = await discover(relays, { rpId: 'nostkey.org' })To have your origin authorized for cross-client login via nostkey.org, add your domain to the origins list via PR.
Register passkeys on both gateways. No single point of failure. No single provider to trust.