Flowsta
Identity Toolkit / Platform
Community
Details
License Open source (claimed on features comparison table); no public repository URL confirmed in documentation
Dev Status 🟢 Active
Dev Status Detail Released (production-ready per developer documentation; free tier live; OAuth integration available; Vault desktop app available for Linux, Mac, Windows; 10,000 MAU free tier)
Owner Eric Doriean (Chief & Founder); formerly founding member of Australia's first publicly listed internet company
Governing Body Founder / single maintainer (Eric Doriean; no foundation, DAO or community governance documented)
Country Australia
Start Year 2026
Stack TypeScript (TypeScript-first SDK; npm installable); JavaScript (OAuth flow); Holochain (backend DHT infrastructure); Ed25519 + BIP39 + PBKDF2 (cryptographic primitives)
Funding Personal investment (founder-funded; no VC or grant funding disclosed)
Last Investigated Jul 1, 2026
Identity Toolkit / Platform Attributes
Origins Decentralized Identity / Authentication (motivated by data exploitation of centralized OAuth providers; founder built it after asking 'why isn't someone building this?' — a privacy-first SSO alternative to Google/Facebook login)
Database Holochain DHT (distributed hash table — user identity and encrypted data stored across Holochain peer network; Flowsta Vault stores keys locally; no central database)
Query Language N/A (identity toolkit; data accessed via OAuth 2.0 token exchange and Holochain DHT retrieval; no general query language)
Data Formats W3C DID (decentralized identifier per user); OAuth 2.0 authorization codes and access tokens; BIP39 mnemonic phrases (24-word recovery); Ed25519 key pairs; TOTP (HMAC-based one-time passwords for 2FA)
Mobile Support Partial mobile support (web-based OAuth flow mobile-accessible; Vault desktop app not available on mobile; no dedicated native mobile app documented)
Web Support Yes (flowsta.com web interface; OAuth authorization endpoint at login.flowsta.com; developer portal at dev.flowsta.com)
Native Apps Native apps (Flowsta Vault desktop app for Linux, macOS, Windows — stores encryption keys locally and enables offline desktop logins to Holochain apps)
Terms Freemium SaaS (free forever core tier — 10,000 MAU, 3 apps; Premium $10/month for short usernames and priority support; Premium+ username tiers $50–$800/year; Developer plans at dev.flowsta.com/pricing)
Funds Undisclosed
Based On Holochain (Int P2P RT — DHT infrastructure for distributed identity storage); W3C DID specification (ID Pro — standards-compliant decentralized identifiers); OAuth 2.0 + PKCE (authentication flow); Ed25519 (cryptographic signatures); BIP39 (recovery phrase standard); PBKDF2 (key derivation)
Permissions OAuth 2.0 scope-based (developer apps request scopes at authorization; user consents at login.flowsta.com; no user data stored on developer servers — token-based access only)
Development Tools TypeScript-first SDK (npm installable — one command install); OAuth 2.0 + PKCE client library; 'Sign in with Flowsta' button assets (SVG, multiple variants); API reference at docs.flowsta.com/api-reference/; code examples at docs.flowsta.com/examples/; Quick Start guide; no secrets required — Client ID only
Authentication & Identity Self-sovereign identity via W3C DID (every user gets a DID based on their Ed25519 keypair); OAuth 2.0 + PKCE (developer integration layer); zero-knowledge architecture (user password never leaves device; Flowsta staff cannot access private data); local-first key storage via Vault; TOTP-based 2FA
Storage Model Hybrid local-first + Holochain DHT (encrypted private data stored on Holochain DHT — distributed across peer network; encryption keys stored locally on user device via Flowsta Vault; no central Flowsta server stores private keys or user data; offline access possible via Vault)
Interoperability W3C DID interoperability (Flowsta DIDs are standards-compliant and work with any W3C DID/VC ecosystem); OAuth 2.0 compatibility (any OAuth 2.0 + PKCE-capable application can integrate); Holochain ecosystem (Vault enables offline login to Holochain desktop apps)
Data Portability High (user data stored on Holochain DHT is portable; if Flowsta disappeared, users could still access data through DHT; 24-word BIP39 recovery phrase enables full key recovery; no lock-in to Flowsta servers)
Governance & Decision Making Founder-controlled (single founder; no DAO, community governance, or foundation structure documented; open source commitment stated but governance model unspecified)
Identity Standards W3C DID (Decentralized Identifiers); OAuth 2.0 + PKCE; BIP39 (mnemonic recovery); TOTP/HMAC (RFC 6238 for 2FA)
Identity Standards - List
DID Methods Supported Holochain-based DID (did method unconfirmed — likely did:holo or custom Holochain DID method; W3C DID compliance stated but specific method not documented publicly)
DID Methods Supported - List
Key Management User-controlled local (Ed25519 keypair generated from user password via PBKDF2; private key stored encrypted on device via Flowsta Vault; BIP39 24-word recovery phrase for backup; password never leaves device)
Credential Types W3C DID-based identity (every user gets a verifiable DID; verifiable credentials not explicitly documented as a separate feature in current release)
Credential Types - List
Verification Method Cryptographic signature verification (Ed25519 keypair; DID-based identity verification; OAuth 2.0 token exchange confirms authentication; zero-knowledge proof of password knowledge without revealing password)
Privacy Features Zero-knowledge architecture (password and private data encrypted client-side; Flowsta staff mathematically cannot access without user password); local-first key storage (keys never sent to server); no email/recovery phrase stored on Flowsta servers; TOTP 2FA secrets stored encrypted; 24-word self-custodied recovery (no email reset interception risk)
Authentication Methods Password (PBKDF2 key derivation; zero-knowledge); TOTP-based 2FA (authenticator app); BIP39 recovery phrase (account recovery); OAuth 2.0 + PKCE (developer integration); offline desktop login via Vault (no internet required)
Revocation Mechanism Unconfirmed; no formal credential revocation mechanism documented; identity persists on Holochain DHT; OAuth tokens expire per standard OAuth lifecycle
Agent Types Supported Humans (individuals; SSO identity service for personal accounts; no organizational or AI agent identity documented)
Wallet/Client Types Web browser (flowsta.com — primary end-user interface); Flowsta Vault (native desktop app for Linux/macOS/Windows — local key storage and offline login)
Recovery Mechanisms BIP39 24-word recovery phrase (self-custodied; must be stored safely by user; no server-side reset possible — by design; loss of phrase and password means permanent loss of access)
Compliance / Regulations Privacy-by-design (GDPR-aligned by architecture — no PII stored on Flowsta servers; zero-knowledge encryption); no formal compliance certifications documented
Credential Exchange Protocols OAuth 2.0 + PKCE (primary developer integration protocol; no DIDComm or OIDC4VC documented in current release)
Credential Exchange Protocols - List
Trust Framework Cryptographic verification only (trust derived from Ed25519 keypair and W3C DID; no trusted issuer registry or government-anchored trust; Holochain DHT provides distributed availability guarantee; no web of trust or reputation system)
Cost Model Free tier (10,000 MAU, 3 apps — no credit card); Premium $10/month (short usernames, priority support); Premium+ usernames $50–$800/year; Developer pricing at dev.flowsta.com/pricing
Censorship Resistance High (identity data stored on Holochain DHT — no central server to shut down or censor; Flowsta staff cannot access or delete user data; if Flowsta company ceased to exist, user identities persist on DHT; no single point of failure)
Relationships
How this tool connects to other tools and organizations, from relationships reviewed by the OpenHaven data steward. They describe how projects connect, not how good they are.
- Built on
- Speaks protocol
- Stores in
- Interoperates with
- Others aiming to interoperate with it