The Tor 0.3.5 series includes client authorization for v3 onion services.

Tor manual:

To configure client authorization on the service side, the "/authorized_clients/" directory needs to exist. Each file in that directory should be suffixed with ".auth" (i.e. "alice.auth"; the file name is irrelevant) and its content format MUST be:


The supported are: "descriptor". The supported are: "x25519". The is the base32 representation of the raw key bytes only (32 bytes for x25519).

How can I generate the ".auth" file?


Openssl 1.1.0 or newer that supports x25519 is required.

openssl genpkey -algorithm x25519 -out key.private.pem

cat key.private.pem | grep -v " PRIVATE KEY" | base64pem -d | tail --bytes=32 | base32 | sed 's/=//g' > private.key

openssl pkey -in private.key -pubout | grep -v " PUBLIC KEY" | base64pem -d | tail --bytes=32 | base32 | sed 's/=//g' > public.key

On the HS side, create .auth with content


On the client side, create .auth_private with content


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.