# Wamen

> Wamen provides passwordless identity proof through one WhatsApp message for web applications. Applications verify a short-lived ES256 identity token, map the pairwise subject to their own user, and create their own session.

Wamen is an experimental free skateboard release at https://wamen.link. It uses one unofficial WhatsApp connection and has no SLA. It is authorization-code-and-PKCE-shaped but does not claim full OAuth or OpenID Connect compliance. Supported scopes are openid and optional phone. @wamenjs/auth@0.1.0 and @wamenjs/server@0.1.0 are published on npm.

## Start here

- [Documentation overview](https://wamen.link/docs): Current public integration surfaces and release constraints.
- [Secure quickstart](https://wamen.link/docs/quickstart): Published server verifier, hosted or packaged browser flow, app-owned session, tests, and an AI coding-agent prompt.
- [Hosted script](https://wamen.link/docs/hosted-script): Script and link attributes, callback event, navigation cancellation, and window.Wamen API.
- [Server verification](https://wamen.link/docs/server-verification): Exact ES256, issuer, audience, lifetime, subject, amr, and optional phone checks.
- [Security boundaries](https://wamen.link/docs/security): Identity, browser, server, session, redirect, phone, and operational responsibilities.
- [Browser package](https://www.npmjs.com/package/@wamenjs/auth): Bundled browser PKCE, redirect, callback, storage, and cleanup API.
- [Server package](https://www.npmjs.com/package/@wamenjs/server): Discovery, JWKS caching, ES256 verification, and typed Wamen identity API.

## Machine context

- [Full Wamen integration context](https://wamen.link/llms-full.txt): Self-contained current contract, verified code snippets, error behavior, and AI-agent instructions.
- [Discovery metadata](https://wamen.link/.well-known/wamen-configuration): Current issuer, authorization, token, JWKS, scopes, and PKCE method.
- [Public JWKS](https://wamen.link/.well-known/jwks.json): Public ES256 signing keys.

## Optional

- [Service status](https://wamen.link/status): Current public availability.
- [Privacy policy](https://wamen.link/privacy): Data handling and retention.
- [Terms of use](https://wamen.link/terms): Experimental service terms and integrator responsibilities.
- [Deletion](https://wamen.link/deletion): Verified Wamen principal deletion behavior.