A cryptographic identity for the app beside you
Not every useful application has a public domain. Desktop tools, homelab services, LAN dashboards, and private deployments still need a safe way to request identity without pretending that localhost is globally unique.
LinkKeys local relying parties identify an application by its signing-key fingerprint.
The flow
- The application creates signing and encryption keys and presents a signed descriptor.
- CatalystLinkKeys validates the descriptor and applies the domain's local-app admission policy.
- You authenticate and review the application's requested claims.
- LinkKeys returns an encrypted callback bound to the application's fingerprint and keys.
- The application redeems its single-use claim ticket by proving possession of the matching key.
Names and local domain hints are display context, not identity. The key fingerprint is the stable identifier you should compare when approving an application.
Operator review
This domain defaults to administrator approval for new local-app fingerprints. Operators can approve, deny, or permanently revoke a fingerprint and record review notes. Users still provide consent after domain admission; approval does not silently release anyone's claims. If a user wants to use this IDP with a local app, they'll just need to get approval first. This policy will change later when support burden increases, but priority is for security of users. The easiest way is to put it behind a domain and setup an RP, which is also free and easy to do.
For SDK and wire-level details, visit the LinkKeys local-RP documentation.