DAuth
Fully OAuth compliant decentralized identity provider with automatic payment using x402
Demo
About
Against the background of spreading centralized social login like Google login and strong privileges like creating arbitrary access token, this project built decentralized identity provider so that no entity holds such privileges. In contrast of existing decentralized scheme like DID, it's compliant with OAuth protocol which assumes centralized server. Our approach also place single server but it doesn't have any ability to create access token by itself, but manage decentralized nodes as parts of entire authentication process. As the result, only someone who knows the password can acquire valid access token. So far, it's description of existing project. This time, I integrated x402 payment for token issuance aiming to complete economics and make it sustainable. Typically, social login services are provided free but connected to another centralized commercial stuff like advertisement or other SaaS. To keep decentralized, independent ecosystem is better instead creating large ecosystem with another commercial entity. Also, I completed missing features of existing project, like sign-up feature. While it works well, especially required update on RP is so small to introduce, the limitation is the incentive mechanism for RPs, "Why I need to join it instead of existing IdPs?". It's future work.
How it's made
This project uses Threshold-OPRF to hide any hint of password from servers, and FROST threshold signature to decentralize signing operation. Merging these two technique is defined in existing paper, called PASTA. I used that concept. Also, to be compliant with OAuth, I introduced gateway server without give any privileges to it because OAuth is a protocol that assumes single server. DPoP is an important part to do so, since gateway server eventually knows access token but it should not have any ability. So far it's about existing project. This time I integrated x402 libraries of Typescript into it. To minimize RP's stress, APIs are considered so that RP only need to put x402 plugin into common OAuth framework. RPs pay USDC on Base Sepolia to get access token, and gateway server pays also USDC to each node to get calculation material.