BAC cannot reach its database.

Bind your Cloudflare D1 database to the Pages project with the exact variable name DB, then redeploy. BAC creates its schema automatically.

Initialize BAC.

Create the first administrator. After initialization, issue that administrator a .bac credential file before signing out.

OrganizationAdministrator display nameAdministrator username

Present your BAC.

Your encrypted credential file is the possession factor. Its private key is decrypted locally and used only to sign a one-time challenge.

Select BAC Credential

BAC file password

The .bac file and its password are never uploaded. BAC sends only the credential ID and cryptographic signature needed for authentication.

Control Center

People

—

Active BAC files

—

Audit events

—

BAC v2 credential model

Each issued .bac file contains identity metadata plus an AES-256-GCM encrypted ECDSA P-256 private key. D1 stores the public key and lifecycle state. Copying the file alone is insufficient without its file password, and the server can revoke the credential at any time.

Add person

Name

Username

Role

Person	Username	Role	Status	Actions

Important: BAC does not keep a recoverable copy of an issued private key. If a .bac file is lost, revoke it and issue a replacement.

Credential	Owner	Type	Status	Expires	Action

Time	Action	Target

Database backup

Export BAC server records as a JSON backup. Private keys are never included because they exist only inside user-owned .bac files.

Recovery model

Keep database backups and credential-file backups separately. Restoring D1 records cannot recreate a lost .bac private key.