Here is a complete, single-file Node.js reference service. It acts as a
third-party application (e.g., a forum, a mesh dashboard, or a game) that uses
OmegaID for user registration and authentication.

Since you are running modern Node.js environments (like the ones running your
Fastify API gateways and O-Base engine), this script uses zero external NPM
dependencies. It uses standard node:http and native node:crypto.webcrypto so
you can just copy, paste, and run it.

mock-service.js

import http from 'node:http'; import crypto from 'node:crypto'; import { URL }
from 'node:url'; // Define the OmegaID endpoint we built previously const
OMEGA_ID_URL = 'http://localhost:8080'; // Change to https://id.omega-mesh.org
in production // --- IN-MEMORY DATABASE --- // In your real stack (like
O-Base), you'd persist these. const usersDB = new Map(); // omega_id -> {
publicKey: JWK } const activeChallenges = new Map(); // challengeString -> {
omega_id, expiresAt } const activeSessions = new Map(); // sessionToken -> {
omega_id } // --- OMEGA-ID VERIFICATION ENGINE --- const OmegaVerify = {
utils: { utf8: new TextEncoder(), b642buf: (b64) => Uint8Array.from(atob(b64),
c => c.charCodeAt(0)) }, async verify(publicJwk, dataString, signatureB64) {
const webcrypto = crypto.webcrypto; try { const verifyKey = await
webcrypto.subtle.importKey( "jwk", publicJwk, { name: "ECDSA", namedCurve:
"P-256" }, true, ["verify"] ); const signature = this.utils.b642buf(signatureB6
4); return await webcrypto.subtle.verify( { name: "ECDSA", hash: { name:
"SHA-256" } }, verifyKey, signature, this.utils.utf8.encode(dataString) ); }
catch (err) { console.error("Verification error:", err); return false; } } };
// --- SERVER LOGIC --- const server = http.createServer(async (req, res) => {
const reqUrl = new URL(req.url, `http://${req.headers.host}`); // 1. FRONTEND:
Display the Mock App UI if (reqUrl.pathname === '/' && req.method === 'GET') {
res.writeHead(200, { 'Content-Type': 'text/html' }); res.end(` <!DOCTYPE
html><html><body style="font-family: monospace; background: #0d1117; color:
#c9d1d9; padding: 40px;"> <h2>Mock App // Secured by OmegaID</h2> <div
style="border: 1px solid #30363d; padding: 20px; max-width: 500px;"> <h3>1.
Register (First Time)</h3> <p style="font-size: 0.8em; color: #8b949e;">Upload
your ID file so we can save your Public Key.</p> <input type="file"
id="id-file" accept=".json" onchange="register()"> <hr style="border-color:
#30363d; margin: 20px 0;"> <h3>2. Login (Returning)</h3> <input type="text"
id="log
in-id" placeholder="omg_1a2b3c..." style="width:100%; padding: 8px;
margin-bottom: 10px;"> <button onclick="login()" style="padding: 10px; cursor:
pointer; background: #58a6ff; border:none; border-radius: 4px;">Login via
OmegaID</button> </div> <script> async function register() { const file =
document.getElementById('id-file').files[0]; const text = await file.text();
const idData = JSON.parse(text); // Send ONLY the public parts to the server
const res = await fetch('/api/register', { method: 'POST', body:
JSON.stringify({ omega_id: idData.omega_id, publicKey: idData.publicKey }) });
alert(await res.text()); } function login() { const id = document.getElementByI
d('login-id').value; if(!id) return alert('Enter your omega_id');
window.location.href = '/api/login/start?omega_id=' + encodeURIComponent(id);
} </script> </body></html> `); return; } // 2. API: Registration (Save the
Public Key) if (reqUrl.pathname === '/api/register' && req.method === 'POST')
{ let body = ''; req.on('data', chunk => body += chunk.toString());
req.on('end', () => { const { omega_id, publicKey } = JSON.parse(body);
usersDB.set(omega_id, { publicKey }); // Save public key to DB!
console.log(`[DB] Registered new user: ${omega_id}`); res.writeHead(200);
res.end(`Registration successful for ${omega_id}. You can now login.`); });
return; } // 3. API: Start Login (Generate Challenge & Redirect) if
(reqUrl.pathname === '/api/login/start' && req.method === 'GET') { const
omega_id = reqUrl.searchParams.get('omega_id'); if (!usersDB.has(omega_id)) {
res.writeHead(400); return res.end("User not registered. Please register
first."); } // Generate a cryptographic nonce (challenge) const challenge =
crypto.randomBytes(32).toString('hex'); // Store challenge with a 5-minute
expiration activeChallenges.set(challenge, { omega_id, expiresAt: Date.now() +
5 * 60 * 1000 }); // The callback URL where id.omega-mesh.org will send the
user back const callbackUrl = `http://${req.headers.host}/api/login/verify`;
// Redirect user to the OmegaID Terminal const red
irectUrl = `${OMEGA_ID_URL}/?action=auth&challenge=${challenge}&callback=${enco
deURIComponent(callbackUrl)}`; res.writeHead(302, { 'Location': redirectUrl
}); res.end(); return; } // 4. API: Verify Login Callback if (reqUrl.pathname
=== '/api/login/verify' && req.method === 'GET') { const returned_id =
reqUrl.searchParams.get('omega_id'); const signature = reqUrl.searchParams.get(
'signature'); // In a real app, you'd pass the challenge in the URL state or
via a secure cookie. // For this demo, we'll just find the active challenge
for this user. const [challenge, session] = [...activeChallenges.entries()].fin
d(([k, v]) => v.omega_id === returned_id) || []; if (!challenge ||
session.expiresAt < Date.now()) { res.writeHead(401); return res.end("Challenge
 expired or invalid."); } const userRecord = usersDB.get(returned_id); if
(!userRecord) { res.writeHead(401); return res.end("User not found in DB."); }
// VERIFY THE SIGNATURE const isValid = await OmegaVerify.verify(userRecord.pub
licKey, challenge, signature); if (isValid) { // Consume the challenge so it
can't be used again (Replay Protection) activeChallenges.delete(challenge); //
Issue session cookie (Mock) res.writeHead(200, { 'Content-Type': 'text/html'
}); res.end(` <body style="font-family: monospace; background: #0d1117; color:
#2ea043; padding: 40px;"> <h2>Access Granted</h2> <p>Welcome back,
${returned_id}</p> <p>Cryptographic signature verified successfully.</p> <a
href="/" style="color: #58a6ff;">Go Home</a> </body> `); } else {
res.writeHead(401); res.end("Cryptographic verification failed. Forged
signature."); } return; } res.writeHead(404); res.end("Not Found"); });
server.listen(3000, () => { console.log("Mock Service running on
http://localhost:3000"); console.log(`Make sure OmegaID Terminal is running at
${OMEGA_ID_URL}`); }); 

How to test the whole flow:

Serve OmegaID: Put the index.html from the previous step in a folder and run a
quick local server on port 8080 (e.g., python3 -m http.server 8080 or host it
on your Cloudflare tunnel).

Run the Mock Service: Save the code above as mock-service.js and run it:node
mock-service.js 

The Workflow:

Go to http://localhost:3000.

Register: Click "Choose File" under the Register section and select the
omega_id.json file you generated earlier. This tells the database: "Here is my
public key."

Login: Copy your omg_... ID from the JSON file, paste it into the Login box,
and click "Login".

The Handoff: You will be instantly redirected to your id.omega-mesh.org GUI.
It will prompt you for your file and passphrase.

The Return: Once signed, it instantly redirects you back to port 3000, where
Node.js verifies the ECDSA signature against the challenge nonce it saved in
memory. You are logged in!

Key Design Pattern Used Here: "Registration by Declaration"

Notice how registration works in this snippet. The user doesn't create a
password with the service. They just submit the omega_id and the publicKey
object. Because the service now has the public key, no one else can ever login
as that omega_id unless they hold the encrypted private key and the
passphrase.