Skip to main content
Ave is an identity provider for apps that need to be secure and end-to-end encrypted. Users sign in with a passkey, your app receives standard OpenID Connect tokens, and, when you ask for it, a per-user encryption key that only the user’s device and your client code ever see in plaintext. Ave’s servers store encryption keys only in a form wrapped by the user’s master key. The master key is unlocked on the user’s device during sign-in, the app key is unwrapped in the browser, and it reaches your app in the callback URL fragment, which browsers never send to a server.

​
What you get

End-to-end encryption keys

Request e2ee:symmetric for a per-user AES-256 key, or e2ee:asymmetric for a keypair plus public-key lookup so users can encrypt for each other.

Passkey accounts

Passwordless sign-in, account recovery, and multiple identities per account. Your app never handles credentials.

Standard OAuth 2.0 and OIDC

Authorization code flow with PKCE, ID tokens, refresh token rotation, discovery, and JWKS.

Your app's structure

Ave gives you a verified identity. Workspaces, membership, roles, and billing stay in your app.

​
How an encrypted app uses Ave

1

Register your app

Create an app at devs.aveid.net and register its callback URL. Every integration uses a registered client ID.
2

Ask for an encryption scope

Add e2ee:symmetric or e2ee:asymmetric to the scopes you request at sign-in. The consent screen tells the user that your app is end-to-end encrypted.
3

Receive the key with the tokens

completeOAuthCallback from @ave-id/sdk/client or the onTokens callback in @ave-id/embed hands you the tokens and the key together. The key comes from the URL fragment, not from the token endpoint.
4

Encrypt on the client

Encrypt user data with the key before it leaves the device. Your backend stores ciphertext and uses the verified id_token to decide who can read which rows.
The Quickstart walks through these steps with code.

​
Hosts

Send token requests to https://api.aveid.net/api/oauth/token. Users sign in on https://aveid.net.

​
Where to go next

Quickstart

Register an app, request an encryption key, and sign a user in.

Encryption model

Where keys are generated, how they are wrapped, and what Ave can and cannot see.

Public clients and PKCE

Browser, desktop, and mobile apps without a client secret.

Convex and Expo

Framework guides for common Ave setups.
Last modified on September 28, 2026