{"_id":"0cert-middleware","name":"0cert-middleware","dist-tags":{"latest":"1.0.0"},"versions":{"1.0.0":{"name":"0cert-middleware","version":"1.0.0","description":"Drop-in Express middleware for 0Cert identity-based encryption. Zero certificates. Zero renewals.","main":"index.js","scripts":{"test":"node test.js"},"keywords":["0cert","ibc","identity-based-cryptography","certificateless","ssl-replacement","security","encryption","express","middleware"],"author":{"name":"0Cert","email":"hello@0cert.io"},"license":"MIT","repository":{"type":"git","url":"git+https://github.com/0cert/middleware.git"},"homepage":"https://0cert.io","bugs":{"url":"https://github.com/0cert/middleware/issues"},"engines":{"node":">=16.0.0"},"gitHead":"a9e9ed2a3eaa83a1ef1664c602d5cddbba2c6c21","_id":"0cert-middleware@1.0.0","_nodeVersion":"24.16.0","_npmVersion":"11.13.0","dist":{"integrity":"sha512-InKD/MmyrOQLlfbSH2XbU+9zS9OtVoX3SglkDeFvk+91tcNd5RzbFH2nz8rsmc1XdN4V9nANMOCR+ZhKsHbFvw==","shasum":"6e66ffba62bd70ffa0197391563c71ec81ac560d","tarball":"https://registry.npmjs.org/0cert-middleware/-/0cert-middleware-1.0.0.tgz","fileCount":4,"unpackedSize":18141,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEYCIQC9lzd0nLHiOL4RhQsWWjvahG6nzmROmnFCbPgQGue0owIhAJmgg/gFuUsqaq25l0RbCB75FalhevtGLD0P2/Z8Ubs+"}]},"_npmUser":{"name":"0cert","email":"appsitetown@gmail.com"},"directories":{},"maintainers":[{"name":"0cert","email":"appsitetown@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/0cert-middleware_1.0.0_1781555475932_0.9217355163080447"},"_hasShrinkwrap":false}},"time":{"created":"2026-06-15T20:31:15.843Z","1.0.0":"2026-06-15T20:31:16.079Z","modified":"2026-06-15T20:31:16.490Z"},"maintainers":[{"name":"0cert","email":"appsitetown@gmail.com"}],"description":"Drop-in Express middleware for 0Cert identity-based encryption. Zero certificates. Zero renewals.","homepage":"https://0cert.io","keywords":["0cert","ibc","identity-based-cryptography","certificateless","ssl-replacement","security","encryption","express","middleware"],"repository":{"type":"git","url":"git+https://github.com/0cert/middleware.git"},"author":{"name":"0Cert","email":"hello@0cert.io"},"bugs":{"url":"https://github.com/0cert/middleware/issues"},"license":"MIT","readme":"# 0cert-middleware\n\n> Drop-in Express middleware for [0Cert](https://0cert.io) — identity-based encryption for Node.js.  \n> Zero certificates. Zero renewals. Zero CAs.\n\n---\n\n## Install\n\n```bash\nnpm install 0cert-middleware\n```\n\n## Usage\n\n```javascript\nconst express   = require('express')\nconst zerocert  = require('0cert-middleware')\n\nconst app = express()\n\napp.use(zerocert({\n  identity:    'mysite.com',               // your domain\n  fullPrivKey: process.env.IBC_PRIV_KEY,   // from 0 Browser app or KGC API\n  userSecret:  process.env.IBC_USER_SECRET, // generated during key setup\n  kgc:         'https://kgc.0cert.io'      // public KGC (or your own)\n}))\n\napp.get('/', (req, res) => {\n  res.send('Hello! This site is 0Cert protected.')\n})\n\napp.listen(3000)\n```\n\nThat's it. Your site now:\n- Serves `/.well-known/0cert` — verified by 0 Browser automatically\n- Adds `X-0Cert-*` headers to all responses\n- Shows **0Cert Verified** badge to 0 Browser users\n\n---\n\n## Get your keys\n\n**Option 1 — 0 Browser app (easiest)**\n1. Download 0 Browser on iOS\n2. Go to My Sites tab → tap +\n3. Enter your domain\n4. Copy the keys shown\n\n**Option 2 — KGC API directly**\n```bash\n# 1. Generate user secret\ncurl -X POST https://kgc.0cert.io/user/generate-secret\n\n# 2. Issue partial key for your domain\ncurl -X POST https://kgc.0cert.io/issue-partial-key \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"identity\": \"mysite.com\"}'\n\n# 3. Combine keys\ncurl -X POST https://kgc.0cert.io/user/combine-keys \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"identity\": \"mysite.com\",\n    \"partialKey\": \"...\",\n    \"userSecret\": \"...\"\n  }'\n```\n\nStore the keys as environment variables:\n```bash\nIBC_PRIV_KEY=your_full_priv_key\nIBC_USER_SECRET=your_user_secret\n```\n\n---\n\n## Add DNS TXT record\n\nIn your domain registrar, add:\n```\nTXT  @  ibc-kgc=https://kgc.0cert.io\n```\n\nThis tells 0 Browser which KGC to use for your domain.\n\n---\n\n## Options\n\n```javascript\nzerocert({\n  // Required\n  identity:    'mysite.com',\n  fullPrivKey: '...',\n  userSecret:  '...',\n\n  // Optional\n  kgc:              'https://kgc.0cert.io', // KGC server URL\n  verifyPath:       '/.well-known/0cert',   // verification endpoint path\n  verifyOnStartup:  true,                   // verify with KGC on startup\n  debug:            false,                  // verbose logging\n})\n```\n\n---\n\n## Verification endpoint\n\nThe middleware automatically serves `/.well-known/0cert`:\n\n```json\n{\n  \"ok\": true,\n  \"version\": \"1.0.0\",\n  \"identity\": \"mysite.com\",\n  \"kgc\": \"https://kgc.0cert.io\",\n  \"status\": \"verified\",\n  \"keyId\": \"...\",\n  \"algorithm\": \"CL-PKC-ECDH-v2\"\n}\n```\n\n0 Browser calls this endpoint when visiting your site to show the verified badge.\n\n---\n\n## Response headers\n\nAdded to every response:\n\n```\nX-0Cert-Identity:  mysite.com\nX-0Cert-KGC:       https://kgc.0cert.io\nX-0Cert-Status:    verified\nX-0Cert-Version:   1.0.0\nX-0Cert-Algorithm: CL-PKC-ECDH-v2\n```\n\n---\n\n## Decrypt messages (optional)\n\nIf you receive encrypted messages via the 0Cert protocol:\n\n```javascript\nconst zerocert = require('0cert-middleware')\n\nconst config = {\n  identity:    'mysite.com',\n  fullPrivKey: process.env.IBC_PRIV_KEY,\n  userSecret:  process.env.IBC_USER_SECRET,\n}\n\n// Decrypt an envelope received from a 0Cert client\nconst plaintext = zerocert.decrypt(config, envelope)\nconsole.log(plaintext) // → original message\n```\n\n---\n\n## Enterprise / private KGC\n\nPoint to your own KGC server:\n\n```javascript\napp.use(zerocert({\n  identity:    'mysite.com',\n  fullPrivKey: process.env.IBC_PRIV_KEY,\n  userSecret:  process.env.IBC_USER_SECRET,\n  kgc:         'https://kgc.yourcompany.com', // private KGC\n}))\n```\n\nSee [github.com/0cert/kgc-server](https://github.com/0cert/kgc-server) to self-host.\n\n---\n\n## How it works\n\n```\nTraditional SSL:\n  CA signs certificate → browsers trust ~150 CAs → encrypted connection\n  Problem: any CA can fake any certificate\n\n0Cert (CL-PKC):\n  KGC issues partial key → you generate user secret → combined = full key\n  Encryption uses ECDH P-256 against your public key\n  Even the KGC cannot decrypt your traffic\n```\n\n→ [Read more at 0cert.io](https://0cert.io)\n\n---\n\n## License\n\nMIT — [0cert.io](https://0cert.io)\n","readmeFilename":"README.md","_rev":"1-af319489fd26d46b57c5ebbcc2d9cc05"}