Protocol deep dives, tutorials, and architecture notes — everything you need to build on Me2eM.
JWT, OAuth and Me2eM solve the same task — authorization. But trust models are fundamentally different: who signs, who does the server trust, and what happens on compromise. A full comparison with code examples.
How a signed token replaces a server session: what's inside, what the verifier checks, how stateless differs from JWT — and why jti rotation makes revocation pinpoint.
A complete breakdown of the deterministic key tree: how 12 words become a hierarchy of identities — Identity, Handle, SubHandle — and why the same seed always yields the same keys.
Mode 2 in its pure form: a drone sells 30 minutes of camera time, a satellite sells a tasking window. The buyer verifies the purchase with the public root, the operator keeps no ledger, the receipt cannot be forged or extended.
Multi-App SSO pattern on Me2eM: one instance, many applications, zero user tables. Per-app personas, attestation chains instead of IdP, HttpOnly sessions and ban without a database — rooted in identity.
Seed-UX as an engineering problem: show-once display, order-verification, checksum import, passphrase warnings — each component in the package answers for a specific catastrophe. Plus sessions with auto-renewal and encrypted context cache.
A systematic tour of the Me2eM cryptographic package: HKDF and domain separation, X3DH with mandatory OTK, channels with epoch rotation, envelopes for offline recipients, media encryption and password guard rails.
The server side of the protocol: NestJS Guard for verifyAttested, minimal state inventory — public roots, revocations, admin mapping — error routing and horizontal scaling without sticky sessions.
An honest breakdown of seven design decisions: determinism over storage, stateless sessions, two verification modes, attestations over roles, name canonicality, fresh salt for cache, and zero-fallback ban — with alternatives and what we'd do differently.
Step-by-step construction of a charging station network: provisioning via attestations, autonomous operation without a server, compromise isolation to a single connector, third-party app verification.
Step-by-step tutorial: deterministic identity from seed phrase, X3DH channel with offline recipient, per-message encryption with replay protection. Code for all steps — in the article.
The seed phrase is the sole carrier of your identity. We don't store it. Why this is a deliberate decision, the price you pay for it, and why that price is more honest than the alternative.
How to revoke signed tokens when there are no server sessions: granularity of revocation, fail-open vs fail-closed, record TTLs and why stateless ≠ irrevocable.
From storage to computation: how a seed phrase replaces a password database. Service isolation at the key-tree level, contexts without a registry, rotation through naming — and the honest price of forgoing a vault.
A zero-trust-to-server messenger concept: identity without registration, stateless session verification, X3DH chats, epoch rotation of group keys, and the honest price of privacy.
Install a package, follow the quick start, and verify your first stateless session in minutes.