keslr/keslr_connect

Connect your service to Keslr: sign in with Keslr and read the verification claim that proves a user is a real, vouched-for human — plus run services reachable only by Keslr members.

What it solves

Keslr Connect provides tools for developers to build applications that only allow verified humans to access them. It solves the problem of bot-driven spam and fake accounts by leveraging a trust graph of vouched-for members and a private network where only verified users can establish TCP connections.

How it works

The project consists of three TypeScript packages that integrate with the Keslr network:

  • @keslr/auth: An OpenID Connect (OIDC) relying party that allows users to sign in and provides claims about their verification status.
  • @keslr/express: A set of Express.js routes and guards that simplify the implementation of the OIDC login flow.
  • @keslr/network: A tool that resolves the network address of an incoming request to the identity of the verified human owning that device.

Applications can either use a full OIDC login for explicit consent and sessions, or rely on network-level identity resolution for low-friction access without traditional accounts.

Who it’s for

Developers building services, forums, or dashboards that require a high degree of certainty that their users are real people, without wanting to manage complex registration, CAPTCHAs, or email verification loops.

Highlights

  • Trust-Graph Verification: Uses a chain of vouches from existing members to verify humans.
  • Network-Level Identity: Allows identity resolution based on the network address, potentially eliminating the need for signup forms and passwords.
  • Security-First Design: Hard-codes RS256, enforces PKCE, and uses constant-time comparisons to prevent common JWT and timing attacks.
  • Zero Runtime Dependencies: The core @keslr/auth package has no runtime dependencies.

Related

  • Project
    octelium/octelium

    A self-hosted zero trust secure access platform that provides identity-based, secretless access to private resources, AI gateways, and containerized applications.

  • Project
    vercel/ai

    A provider-agnostic TypeScript toolkit for building AI-powered applications and agents with a unified API for multiple LLM providers and integrated UI hooks.

  • Project
    samchon/ttsc

    A TypeScript-Go toolchain that integrates type-checking, linting, and compiler-powered plugins to streamline builds and provide AI agents with a structured knowledge graph of the code.

  • Project
    casdoor/casdoor

    An open-source, self-hosted identity and access management platform providing single sign-on (SSO) and centralized user directory management.

  • Project
    BakeLens/crust

    Crust is an open‑source, locally‑run proxy that sits between AI coding assistants and LLM providers. It inspects every tool call (file reads, shell commands, network requests) and blocks actions that could expose secrets or harm the host. The gateway works as an HTTP proxy, MCP/ACP stdio wrapper, or Docker container, and includes 42 built‑in security rules, 51 DLP patterns, and a plugin system for custom policies. It runs entirely on the user’s machine, stores logs encrypted in the OS keyring, and offers iOS integration via a Swift package.