Flowsta
Identity Toolkit / Platform
Community
Links
Details
License Open source (claimed on features comparison table); no public repository URL confirmed in documentation
Dev Status 🟢 Active
Dev Status Detail Released (production-ready per developer documentation; free tier live; OAuth integration available; Vault desktop app available for Linux, Mac, Windows; 10,000 MAU free tier)
Owner Eric Doriean (Chief & Founder); formerly founding member of Australia's first publicly listed internet company
Country Australia
Start Year 2026
Stack TypeScript (TypeScript-first SDK; npm installable); JavaScript (OAuth flow); Holochain (backend DHT infrastructure); Ed25519 + BIP39 + PBKDF2 (cryptographic primitives)
Funding Personal investment (founder-funded; no VC or grant funding disclosed)
Last Investigated Jul 1, 2026
Identity Toolkit / Platform Attributes
Origins Decentralized Identity / Authentication (motivated by data exploitation of centralized OAuth providers; founder built it after asking 'why isn't someone building this?' — a privacy-first SSO alternative to Google/Facebook login)
Database Holochain DHT (distributed hash table — user identity and encrypted data stored across Holochain peer network; Flowsta Vault stores keys locally; no central database)
Query Language N/A (identity toolkit; data accessed via OAuth 2.0 token exchange and Holochain DHT retrieval; no general query language)
Data Formats W3C DID (decentralized identifier per user); OAuth 2.0 authorization codes and access tokens; BIP39 mnemonic phrases (24-word recovery); Ed25519 key pairs; TOTP (HMAC-based one-time passwords for 2FA)
Mobile Support Partial mobile support (web-based OAuth flow mobile-accessible; Vault desktop app not available on mobile; no dedicated native mobile app documented)
Web Support Yes (flowsta.com web interface; OAuth authorization endpoint at login.flowsta.com; developer portal at dev.flowsta.com)
Native Apps Native apps (Flowsta Vault desktop app for Linux, macOS, Windows — stores encryption keys locally and enables offline desktop logins to Holochain apps)
Terms Freemium SaaS (free forever core tier — 10,000 MAU, 3 apps; Premium $10/month for short usernames and priority support; Premium+ username tiers $50–$800/year; Developer plans at dev.flowsta.com/pricing)
Funds Undisclosed
Based On Holochain (Int P2P RT — DHT infrastructure for distributed identity storage); W3C DID specification (ID Pro — standards-compliant decentralized identifiers); OAuth 2.0 + PKCE (authentication flow); Ed25519 (cryptographic signatures); BIP39 (recovery phrase standard); PBKDF2 (key derivation)
Permissions OAuth 2.0 scope-based (developer apps request scopes at authorization; user consents at login.flowsta.com; no user data stored on developer servers — token-based access only)
Development Tools TypeScript-first SDK (npm installable — one command install); OAuth 2.0 + PKCE client library; 'Sign in with Flowsta' button assets (SVG, multiple variants); API reference at docs.flowsta.com/api-reference/; code examples at docs.flowsta.com/examples/; Quick Start guide; no secrets required — Client ID only
Authentication & Identity Self-sovereign identity via W3C DID (every user gets a DID based on their Ed25519 keypair); OAuth 2.0 + PKCE (developer integration layer); zero-knowledge architecture (user password never leaves device; Flowsta staff cannot access private data); local-first key storage via Vault; TOTP-based 2FA
Storage Model Hybrid local-first + Holochain DHT (encrypted private data stored on Holochain DHT — distributed across peer network; encryption keys stored locally on user device via Flowsta Vault; no central Flowsta server stores private keys or user data; offline access possible via Vault)
Interoperability W3C DID interoperability (Flowsta DIDs are standards-compliant and work with any W3C DID/VC ecosystem); OAuth 2.0 compatibility (any OAuth 2.0 + PKCE-capable application can integrate); Holochain ecosystem (Vault enables offline login to Holochain desktop apps)
Data Portability High (user data stored on Holochain DHT is portable; if Flowsta disappeared, users could still access data through DHT; 24-word BIP39 recovery phrase enables full key recovery; no lock-in to Flowsta servers)
Governance & Decision Making Founder-controlled (single founder; no DAO, community governance, or foundation structure documented; open source commitment stated but governance model unspecified)
Identity Standards W3C DID (Decentralized Identifiers); OAuth 2.0 + PKCE; BIP39 (mnemonic recovery); TOTP/HMAC (RFC 6238 for 2FA)
DID Methods Supported Holochain-based DID (did method unconfirmed — likely did:holo or custom Holochain DID method; W3C DID compliance stated but specific method not documented publicly)
Key Management User-controlled local (Ed25519 keypair generated from user password via PBKDF2; private key stored encrypted on device via Flowsta Vault; BIP39 24-word recovery phrase for backup; password never leaves device)
Credential Types W3C DID-based identity (every user gets a verifiable DID; verifiable credentials not explicitly documented as a separate feature in current release)
Verification Method Cryptographic signature verification (Ed25519 keypair; DID-based identity verification; OAuth 2.0 token exchange confirms authentication; zero-knowledge proof of password knowledge without revealing password)
Privacy Features Zero-knowledge architecture (password and private data encrypted client-side; Flowsta staff mathematically cannot access without user password); local-first key storage (keys never sent to server); no email/recovery phrase stored on Flowsta servers; TOTP 2FA secrets stored encrypted; 24-word self-custodied recovery (no email reset interception risk)
Authentication Methods Password (PBKDF2 key derivation; zero-knowledge); TOTP-based 2FA (authenticator app); BIP39 recovery phrase (account recovery); OAuth 2.0 + PKCE (developer integration); offline desktop login via Vault (no internet required)
Revocation Mechanism Unconfirmed; no formal credential revocation mechanism documented; identity persists on Holochain DHT; OAuth tokens expire per standard OAuth lifecycle
Agent Types Supported Humans (individuals; SSO identity service for personal accounts; no organizational or AI agent identity documented)
Wallet/Client Types Web browser (flowsta.com — primary end-user interface); Flowsta Vault (native desktop app for Linux/macOS/Windows — local key storage and offline login)
Recovery Mechanisms BIP39 24-word recovery phrase (self-custodied; must be stored safely by user; no server-side reset possible — by design; loss of phrase and password means permanent loss of access)
Compliance / Regulations Privacy-by-design (GDPR-aligned by architecture — no PII stored on Flowsta servers; zero-knowledge encryption); no formal compliance certifications documented
Credential Exchange Protocols OAuth 2.0 + PKCE (primary developer integration protocol; no DIDComm or OIDC4VC documented in current release)
Trust Framework Cryptographic verification only (trust derived from Ed25519 keypair and W3C DID; no trusted issuer registry or government-anchored trust; Holochain DHT provides distributed availability guarantee; no web of trust or reputation system)
Cost Model Free tier (10,000 MAU, 3 apps — no credit card); Premium $10/month (short usernames, priority support); Premium+ usernames $50–$800/year; Developer pricing at dev.flowsta.com/pricing
Censorship Resistance High (identity data stored on Holochain DHT — no central server to shut down or censor; Flowsta staff cannot access or delete user data; if Flowsta company ceased to exist, user identities persist on DHT; no single point of failure)