BlackWall is a production-grade authorization server where passwords simply don't exist. Hardware keys, passkeys, and platform authenticators combined with fully standards-compliant OAuth 2.1 and OpenID Connect give your applications authentication infrastructure that can't be phished, breached, or guessed.
Every login through BlackWall is backed by a cryptographic assertion from a hardware device or platform authenticator. There is no password database to breach, no credential stuffing surface, no phishing vector.
Every user authenticates via WebAuthn: hardware security keys, Touch ID, Face ID, or Windows Hello. No passwords are accepted, stored, or ever transmitted.
Issue authorization codes, access tokens, and refresh tokens to any OAuth-capable client. PKCE (S256 only) is enforced on every flow.
Full OIDC support: discovery document, JWKS endpoint, signed ID tokens, and UserInfo endpoint.
Organisations, projects, users, and OAuth clients are fully isolated. Every issued token carries project context.
Define up to ten named, tiered privilege levels per project without bespoke role logic in every service.
Every authentication, token issue, admin action, and security event is logged with correlation IDs and exportable history.
/.well-known/openid-configuration so OIDC-aware libraries can auto-configure from a single endpoint.
Cryptbin is an end-to-end encrypted pastebin built directly into BlackWall. Your browser generates the encryption key. It never touches the server.
An AES-256-GCM key is generated client-side and never transmitted to the server.
Your browser encrypts the content locally, then uploads only the ciphertext.
Creating, viewing, updating, and deleting entries requires a live WebAuthn assertion.
Entries expire on a configurable schedule, per entry or via system defaults.
Eliminate password reset tickets, replace shared credentials with hardware-verified identities, and get a full audit trail for every authentication event.
Integrate once via standard OIDC discovery and let your framework handle the rest. Build on open protocols with no proprietary lock-in.
Every entry point to BlackWall, from day-to-day user access to full administrative control.