Configure your sovereign PGP identity for passwordless login
Identity
Your PGP key fingerprint. Run gpg --list-keys to find it.
Service
Base URL of the CapAuth verification service to authenticate against.
Key Custody
Your private key lives on your phone, encrypted at rest. This device sends the
challenge to the phone over a relay; the phone shows the website + fingerprint, you approve, and
the phone returns the signature. The relay never sees the key.
Used to display + verify which key the phone signs with.
On your phone, open the CapAuth Bunker PWA (served at /bunker/ on
the CapAuth service), import your key, then scan this QR. Set the broker URL below.
Where the broker (/bunker/session + /bunker/ws) lives. Use a Tailscale Funnel URL when remote.
Your private key is stored unencrypted in the browser's local storage.
This is for testing only — prefer "Encrypted key" or "Local gpg-agent" for real use.
The key never leaves this extension and is never transmitted to any server.
Export with gpg --armor --export-secret-keys <fingerprint>. Signs challenge nonces locally — never sent to any page. ⚠ Stored unencrypted.
Your key is encrypted at rest with a passphrase-derived key (PBKDF2-SHA256 ≥210k iters → AES-GCM).
Only the ciphertext is stored — never the plaintext key. Decrypted into memory on unlock (~15 min).
Export with gpg --armor --export-secret-keys <fingerprint>. Encrypted with your passphrase below before it touches storage.
Used to derive the AES-GCM key. You'll re-enter it to unlock each session. Choose a strong passphrase — there is no recovery.
A legacy plaintext key is stored. Enter a passphrase above and click
Encrypt existing key to migrate it to encryption-at-rest (the plaintext copy is removed).
The private key never enters the browser. A small native-messaging host
signs via your OS gpg / gpg-agent (smartcard/YubiKey supported).
Passed to the host as gpg --local-user <fp>. Leave blank to use gpg's default secret key.
Not checked
Install the host: from browser-extension/native-host/ run
./install.sh <EXTENSION_ID> (your extension ID is on chrome://extensions).
See the README for macOS / Windows paths.
Export with gpg --armor --export <fingerprint>. Sent to the service on first login for key enrollment (public — safe to share).
Behavior
Auto-sign challenges
Automatically sign and respond when a CapAuth login page is detected
Settings saved
CapAuth - Sovereign Login v0.1.0
One-click passwordless PGP authentication. No passwords. No third parties. Your key is your identity.