Skip to content

FeedKeeper 0.19.0

Choose a tag to compare

View all tags
@visualfusion visualfusion released this 09 Oct 10:57
· 88 commits to main since this release
v0.19.0
0a68adb

FeedKeeper v0.19.0 adds passkeys and optional two-factor authentication to every self-hosted installation.

What's New in v0.19.0

Passkeys

  • Sign in without a password: Register a passkey in Settings → Account and use your device's PIN, fingerprint or face to sign in. FeedKeeper requires user verification and checks the configured origin and RP ID.
  • Manage your credentials: Name multiple passkeys and remove them individually. Private keys and biometric data stay with your credential provider.
  • OAuth sign-in: The connector sign-in page links to the same passkey login before consent.

Authenticator and recovery codes

  • Optional second factor: Set up an authenticator app with a QR code or manual key, confirm a six-digit code, then save ten single-use recovery codes. A verified passkey can sign in on its own.
  • Protected changes: Adding or removing credentials and changing authenticator settings require fresh identity confirmation. Enabling or disabling the authenticator revokes other browser sessions, device/API tokens, OAuth grants, pairing codes and unfinished sign-ins. The current browser remains open so recovery codes can be saved.
  • Operator recovery: The local security:recover command removes a lost authenticator and revokes access without changing passwords or passkeys.

Upgrade notes

  • Back up the database and the existing SESSION_SECRET securely before updating. Authenticator keys are encrypted using that secret; rotating it requires recovery and re-enrollment. Migration 0029 runs automatically, and existing accounts keep their current sign-in until they opt in.
  • Set PUBLIC_URL to the stable external HTTPS origin before enrolling passkeys. Localhost works for development; ordinary HTTP LAN addresses cannot use passkeys. Keep a recovery route when moving domains.
  • Native clients can continue pairing through an authenticated browser and using revocable device tokens.

Documentation: Account security and recovery, Changelog.

Validation: backend and web tests, type checks, production build, cryptographic WebAuthn verification tests and isolated browser checks for passkey enrollment, authenticator setup and mobile layout.

Quick start with Docker

mkdir feedkeeper && cd feedkeeper
curl -fsSLO https://raw.githubusercontent.com/visualfusion/feedkeeper/main/compose.yaml
echo "SESSION_SECRET=$(openssl rand -hex 32)" > .env
docker compose up -d

Open http://localhost:3000, then create the first admin account. Configure HTTPS and PUBLIC_URL before enrolling production passkeys.

README · Native API · Documentation

Assets 2
Loading