Passkey sign-in
for any backend
One small program between your app and your users’ passkeys.
No passwords, no email, no text messages.
Passkeys and nothing else
People sign in with the passkey their phone or laptop already holds. A single recovery code covers the day a device goes missing.
Any language on your side
Parvus speaks plain HTTP on a private socket. Your backend relays a few small requests, so any framework that can make an HTTP call can use it.
One binary, one file
A SQLite file by default and Postgres when you run several instances. Configuration is eight environment variables, with no defaults to discover later.
Your rules, stated once
Every time limit comes from your backend with each call. Parvus keeps no hidden timeouts, rates or thresholds of its own.
Proven the hard way
Every store passes the same contract, a fuzzer compares them step by step, and every change signs in through a real browser.
Small on purpose
Fifteen endpoints, frozen as version one. Parvus does sign-in and recovery, and leaves everything else to the app it serves.