OrbitID
The first fully passwordless SSO. Passkey-first.
At a glance
- Status
- Alpha
- Stack
- WebAuthn · OIDC · Cloudflare Workers · D1
- Contact
- orbitid@luminx.one
Problem
Every SSO of the last decade still treats passkeys as one method among many. Phishing, credential stuffing, and password reset abuse continue to dominate account takeover incidents because the legacy path stays open. OrbitID closes it.
Approach
WebAuthn-only registration. Recovery via attested device transfer or a quorum of trusted contacts, never via email-link reset. Audit-grade logs for every authentication and recovery event, signed and verifiable by the relying party.
Scope
- What it is
-
- A standards-compliant OIDC provider using passkeys exclusively for primary authentication.
- A recovery system grounded in possession and presence rather than email or SMS.
- A drop-in replacement for hosted identity products that still rely on passwords.
- What it is not
-
- A password manager.
- A federated login aggregator that re-routes you to Google or Apple.
- A "passwordless" experience where the password still secretly exists.
Reach
Questions, integrations, security reports, or research collaboration: write to contact@luminx.one or see /security for sensitive disclosure.