Zero secret storage
Remove the need to keep cryptographic keys or bearer tokens around for long periods of time.
HashBack Authentication
Trust without storing secrets.
HashBack gives services a simple way to prove identity over HTTPS using a two-step exchange and verification hashes. Instead of keeping long-lived passwords or API tokens in a vault, the caller and server can mutually reassure each other that the right party is present.
🦉 Engineered by William Godfrey, billpg industries
Two HTTPS transactions
HashBack keeps the exchange short and protocol-friendly, with one request and one verification step.
Built for APIs
Use it for general-purpose API authentication where the service can verify the caller without a shared secret.
From a simple analogy to a practical authentication mechanism
HashBack takes inspiration from a phone-call analogy: one side can prove who they are calling, while the other side can verify the callback. Applied to web authentication, that means a client publishes a verification hash on its own HTTPS site and the server checks it during the exchange.
Why it matters: HashBack helps teams avoid the brittle compromise of storing secrets in the cloud while still giving services a trustworthy identity check.
How the flow works
- The client prepares an authentication claim and calculates a verification hash.
- The client publishes that hash on a TLS-protected URL it controls.
- The server fetches the verification hash, confirms it matches, and accepts the request.
Why teams are paying attention
HashBack is designed for developers who want a cleaner model for authentication: fewer secrets, fewer long-lived credentials, and a clearer trust boundary between client and server.