Auth where the server holds nothing: key-ownership middleware for Express and FastAPI

Every auth system I've ever built has the same problem: the server has to hold a secret. A password hash, a session token, an API key. That secret is a liability. It gets breached. It gets phished. It gets rotated on a schedule nobody follows. I wanted to see if I could build auth where the server holds nothing at all. The result is arken-auth , a middleware for Express and FastAPI that uses…