michal/authentik-qr-login
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

authentik-qr-login: cross-device QR sign-in for authentik

Browse Source 
Scan a QR on your authentik login page with your phone, approve it with a
passkey and a fingerprint, and the laptop signs itself in.

The service holds NO authentik credential. A flow policy calls it with a
session id and gets back the username that approved it, or nothing -- so there
is no standing credential to steal. The obvious alternative, authentik's
recovery-link API, effectively requires a superuser and was rejected for that
reason.

See README.md for the traps this had to work around, including the two
flow-binding settings that are counter-intuitive and load-bearing, and an
honest account of what QR sign-in cannot defend against.
This commit is contained in:
Michal
2026-08-16 17:20:57 +01:00
commit 44061918ac
16 changed files with 2965 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
.gitignore vendored Normal file
View File

@@ -0,0 +1,3 @@
node_modules/
dist/
*.log