Holocron Auth
A simple, user-friendly OAuth system for secure identity verification over mobile number and email — a centralized platform where users control exactly what each linked app can access.
Holocron is an authentication and authorization service built to give developers a secure, easy-to-use, and reliable method of authenticating users. Users verify their mobile number and email ID up front, and from that point Holocron acts as a centralized platform for managing their online presence and controlling access to their personal information.
The design goal that shaped everything else was user control. Holocron gives users complete authority over their own data and the ability to choose which third-party services can access it — so the data stays safe while the authentication experience stays hassle-free. It adheres to privacy regulations and guidelines while still offering developers a seamless integration path.
For developers, it means a robust and scalable authentication system without building one from scratch. Backup login methods keep the authentication process protected against identity theft, number hijacking, and the other failure modes that phone-based auth is prone to.
-
Fast OTPs
Fast, reliable one-time passwords for verification, so users can quickly confirm their mobile number and email ID and securely reach both the platform and every linked app. Twilio handles SMS delivery; Nodemailer handles email.
-
Easy integration
Designed to drop into other applications with minimal friction — simplifying the authentication process for developers while keeping the experience seamless for the end user.
-
Better user control with more data
Complete transparency over app access and data sharing. Users see a list of every app linked to their account and can opt out or unlink from any of them at any time. A security score for each linked app lets users make informed decisions about what they connect to, adding another layer of protection and transparency.
-
Strong security measures
Advanced encryption techniques and security protocols protect user data from unauthorized access — the platform treats privacy and security as the primary constraint rather than a feature.
-
Customisable and scalable
Highly customisable and scalable, so it suits a wide range of applications and use cases. Developers can adapt the platform to their specific needs without losing the security guarantees.
-
Multi-factor authentication
Multi-factor options layer additional protection on top of the primary verification path, guarding against unauthorised access even when one factor is compromised.
-
Granular access controls
Rather than an all-or-nothing grant, users control exactly which data they share with each linked app individually — choosing to share only what a given application genuinely needs.
-
App authentication
Secure authentication for mobile apps, letting users log in without remembering multiple sets of credentials — and removing the need for developers to build a separate authentication system per app.
-
Website authentication
A seamless login experience on the web, eliminating repeated credentials. That increases user engagement and reduces the rate of abandoned accounts.
-
Remote access
Secure authentication for remote workers reaching company resources and services from outside the office — maintaining security without costing productivity.
The application is built on Next.js. The client side covers two surfaces: a web interface in React and Tailwind CSS, and a mobile interface in Flutter. Both talk to the same service.
The server side is a backend built with tRPC, chosen so the entire codebase is typesafe end to end — the contract between client and API is checked at compile time rather than trusted by convention. That mattered more than usual here, because in an auth system a silently mismatched field is a security bug, not a rendering bug.
Data lives in a MySQL server hosted on PlanetScale, with Prisma as the ORM to carry type safety down to the database layer. AWS S3 handles file storage. Security features to defend against potential attacks are built into the system rather than layered on afterwards — which turned out to matter.
The system wasn't just demoed, it was attacked. Over the course of a week, the deployed platform sustained a coordinated cyberattack from more than 200 students simultaneously attempting to break it.
It held. The encryption, the multi-factor paths, and the security scoring were all exercised under genuine adversarial load rather than in a controlled presentation, and the project finished as the highest-scoring one in the course.
Further reading: Jaideep's write-up.