TideCloak – Decentralized IAM for security and user sovereignty
Hey HN! After 6 years of R&D, our small team is excited to share our project TideCloak - an IAM designed to help developers move fast without worrying about catastrophic breaches or overpowered admins with keys to the kingdom. Traditional IAMs rely on centralized authority - admins, root certificates, and decryption keys - which create glaring vulnerabilities in a breach. To address this, we’ve integrated Keycloak (Red Hat’s IAM) with a decentralized key architecture powered by our (academically validated) Ineffable Cryptography. Here’s the idea: keys are split across a decentralized network…
TideCloak – Decentralized IAM for security and user sovereignty launched on December 19, 2024 with 54 votes, #479 of 5,365 launches that month and more than 90% of that year's launches. The site was still online in September 2026, 1 year on.
In plain words
TideCloak is an identity and access management system built on Keycloak that distributes cryptographic keys across a decentralized network rather than centralizing them. It is designed for developers who want to reduce breach risks and prevent administrators from having unrestricted access to authentication systems. The system uses Ineffable Cryptography to split keys so that no single entity holds complete credentials, and users authenticate without their credentials being stored centrally. This architecture aims to eliminate single points of failure in traditional IAM systems.
written from the facts on this page · September 2026
From the sources
TideCloak lets your users hold their own digital authority—no central control, no blind trust. - tide-foundation/tidecloak-gettingstarted
This developer-oriented guide will take you through the minimal steps to set up a development environment with a fully-functional TideCloak server, and build your first very-own Client-Server NextJS web application, secured with TideCloak - all in 5 minutes . 📖 This guide is also available on the TideCloak docs site . for pkg in docker.io docker-doc docker-compose podman-docker containerd runc ; do sudo apt-get remove -y $pkg ; done sudo apt-get update sudo apt-get install -y ca-certificates curl gnupg sudo install -m 0755 -d /etc/apt/keyrings curl -fsSL https://download.docker.com/linux/debian/gpg | sudo tee /etc/apt/keyrings/docker.asc > /dev/null sudo chmod a+r…from github.com
In the maker’s words, at launch
Hey HN! After 6 years of R&D, our small team is excited to share our project TideCloak - an IAM designed to help developers move fast without worrying about catastrophic breaches or overpowered admins with keys to the kingdom. Traditional IAMs rely on centralized authority - admins, root certificates, and decryption…
Does a similar job
all alternatives →
keychains.devFeb 2026 · keychains.dev · ▲177Hi HN — I’m a heavy OpenClaw user and, like many others, I’ve been thinking about how to give these new “unleashed” agents secure access to my accounts. Agents need API access to be useful. But API keys are long-lived secrets. And agents are not secure environments. So I built something for myself that quickly turned into a product: keychains.dev. The idea is simple: agents never see raw credentials. With Keychains.dev: • Agents make API calls via a drop-in replacement for curl or JavaScript’s fetch() • They use template variable names instead of embedding credentials • The request is…
SocketCluster.io – flexible open-source real-time server with pub/sub2016 · socketcluster.io · ▲217Scalable open source pub/sub SDK with support for RPC, JWT authentication and Kubernetes — optimized for async/await
OneCLI – Vault for AI Agents in RustMar 2026 · github.com · ▲161We built OneCLI because AI agents are being given raw API keys. And it's going about as well as you'd expect. We figured the answer isn't "don't give agents access," it's "give them access without giving them secrets." OneCLI is an open-source gateway that sits between your AI agents and the services they call. You store your real credentials once in OneCLI's encrypted vault, and give your agents placeholder keys. When an agent makes an HTTP call through the proxy, OneCLI matches the request by host/path, verifies the agent should have access, swaps the placeholder for the real…
MonoCloud for StartupsJul 2026 · monocloud.com · ▲167One identity layer for your customers, APIs, and agents
SecureAF2025 · secureaf.lovable.app · ▲7Don't get your knickers in a knot. We were surprised too. We are the team behind TideCloak which we shared on HN previously (https://news.ycombinator.com/item?id=42460131). This time we ran an experiment. What happens when you apply a fundamentally different security model to the worst possible development process? Behold... SecureAF https://secureaf.lovable.app/ Build video 6 mins https://youtu.be/tx5MsJ3jeQw The code and UI are questionable and the quality assurance is non-existent. But the security model holds by treating even us as malicious,…
More work this month
the category →
Endless lofi beats composed live in your browser, over pixel-art nights in Paris, Tokyo, New York, Hong Kong, Sydney, San Francisco and more. Free, no sign-up.
Work · 26d ago · loficities.com
Smooth Recorder▲257Mac screen recordings that look edited when you hit stop
Work · 20d ago · smoothrecorder.com
Work · 14d ago · readrare.com
Source: Show HN post ↗ · launch text quoted in part
