diff --git a/README.md b/README.md
index d2365f3..ae0979e 100644
--- a/README.md
+++ b/README.md
@@ -189,13 +189,15 @@ await connection.forward(process.stdout, process.stderr);
 await connection.forwardStreams(child.stdout, child.stderr);
 ```
 
+Note: The URL includes a key, but OpenPull uses a zero-knowledge handshake — the key never leaves your device.
+
 **Connection String Format:**
 ```
 openpull://role:key@publicToken.host:port/
 ```
 
 - `role`: Either `appender` (for sending logs) or `reader` (for receiving logs)
-- `key`: Authentication key derived from your session
+- `key`: Authentication key derived from your session (used only locally to compute the handshake proof)
 - `publicToken`: Session identifier
 - `host:port`: Signaling server address
 
diff --git a/bin/cli.ts b/bin/cli.ts
index bf01ffd..046b0ed 100755
--- a/bin/cli.ts
+++ b/bin/cli.ts
@@ -10,6 +10,8 @@
 import { spawn } from 'node:child_process';
 import { parseArgs } from 'node:util';
 import { createConnection } from '../dist/connection-manager.js';
+import { getActiveWebRTCManager } from '../dist/connection.js';
+import { getBufferSize } from '../dist/log-buffer.js';
 
 const { values, positionals } = parseArgs({
   args: process.argv.slice(2),
@@ -127,13 +129,46 @@ async function main(): Promise<void> {
       process.exit(1);
     });
 
-    child.on('exit', (code, signal) => {
+    child.on('exit', async (code, signal) => {
       if (signal) {
         console.log(`[OpenPull] Child process killed with signal ${signal}`);
       } else {
         console.log(`[OpenPull] Child process exited with code ${code}`);
       }
       cleanup();
+
+      // If we have buffered logs but no readers yet, wait briefly to allow flush
+      const buffered = getBufferSize();
+      const manager = getActiveWebRTCManager();
+      const hasReaders = manager?.getConnectionCount?.() && manager.getConnectionCount() > 0;
+      const maxWaitMs = Number(process.env.OPENPULL_EXIT_DELAY_MS || process.env.OPENPULL_FLUSH_TIMEOUT_MS || 2500);
+
+      if (buffered > 0 && !hasReaders && manager) {
+        await new Promise<void>((resolve) => {
+          let resolved = false;
+          const timeout = setTimeout(() => {
+            if (!resolved) {
+              resolved = true;
+              resolve();
+            }
+          }, Math.max(0, maxWaitMs));
+
+          const unsubscribe = manager.onConnection?.((_peerId: string, connected: boolean) => {
+            if (connected && !resolved) {
+              // Give a tiny moment for buffered send to occur
+              setTimeout(() => {
+                if (!resolved) {
+                  resolved = true;
+                  clearTimeout(timeout);
+                  resolve();
+                }
+              }, 150);
+              if (typeof unsubscribe === 'function') unsubscribe();
+            }
+          });
+        });
+      }
+
       process.exit(code ?? 1);
     });
 
diff --git a/package-lock.json b/package-lock.json
index e479683..e124bda 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -16,8 +16,8 @@
         "openpull": "bin/cli.ts"
       },
       "devDependencies": {
-        "@biomejs/biome": "2.1.4",
-        "@types/node": "^24.2.1",
+        "@biomejs/biome": "2.2.0",
+        "@types/node": "^24.3.0",
         "@types/ws": "^8.18.1",
         "typescript": "^5.9.2"
       },
@@ -26,9 +26,7 @@
       }
     },
     "node_modules/@biomejs/biome": {
-      "version": "2.1.4",
-      "resolved": "https://registry.npmjs.org/@biomejs/biome/-/biome-2.1.4.tgz",
-      "integrity": "sha512-QWlrqyxsU0FCebuMnkvBIkxvPqH89afiJzjMl+z67ybutse590jgeaFdDurE9XYtzpjRGTI1tlUZPGWmbKsElA==",
+      "version": "2.2.0",
       "dev": true,
       "license": "MIT OR Apache-2.0",
       "bin": {
@@ -42,22 +40,22 @@
         "url": "https://opencollective.com/biome"
       },
       "optionalDependencies": {
-        "@biomejs/cli-darwin-arm64": "2.1.4",
-        "@biomejs/cli-darwin-x64": "2.1.4",
-        "@biomejs/cli-linux-arm64": "2.1.4",
-        "@biomejs/cli-linux-arm64-musl": "2.1.4",
-        "@biomejs/cli-linux-x64": "2.1.4",
-        "@biomejs/cli-linux-x64-musl": "2.1.4",
-        "@biomejs/cli-win32-arm64": "2.1.4",
-        "@biomejs/cli-win32-x64": "2.1.4"
+        "@biomejs/cli-darwin-arm64": "2.2.0",
+        "@biomejs/cli-darwin-x64": "2.2.0",
+        "@biomejs/cli-linux-arm64": "2.2.0",
+        "@biomejs/cli-linux-arm64-musl": "2.2.0",
+        "@biomejs/cli-linux-x64": "2.2.0",
+        "@biomejs/cli-linux-x64-musl": "2.2.0",
+        "@biomejs/cli-win32-arm64": "2.2.0",
+        "@biomejs/cli-win32-x64": "2.2.0"
       }
     },
-    "node_modules/@biomejs/cli-darwin-arm64": {
-      "version": "2.1.4",
-      "resolved": "https://registry.npmjs.org/@biomejs/cli-darwin-arm64/-/cli-darwin-arm64-2.1.4.tgz",
-      "integrity": "sha512-sCrNENE74I9MV090Wq/9Dg7EhPudx3+5OiSoQOkIe3DLPzFARuL1dOwCWhKCpA3I5RHmbrsbNSRfZwCabwd8Qg==",
+    "node_modules/@biomejs/biome/node_modules/@biomejs/cli-darwin-x64": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-darwin-x64/-/cli-darwin-x64-2.2.0.tgz",
+      "integrity": "sha512-+OmT4dsX2eTfhD5crUOPw3RPhaR+SKVspvGVmSdZ9y9O/AgL8pla6T4hOn1q+VAFBHuHhsdxDRJgFCSC7RaMOw==",
       "cpu": [
-        "arm64"
+        "x64"
       ],
       "dev": true,
       "license": "MIT OR Apache-2.0",
@@ -69,27 +67,27 @@
         "node": ">=14.21.3"
       }
     },
-    "node_modules/@biomejs/cli-darwin-x64": {
-      "version": "2.1.4",
-      "resolved": "https://registry.npmjs.org/@biomejs/cli-darwin-x64/-/cli-darwin-x64-2.1.4.tgz",
-      "integrity": "sha512-gOEICJbTCy6iruBywBDcG4X5rHMbqCPs3clh3UQ+hRKlgvJTk4NHWQAyHOXvaLe+AxD1/TNX1jbZeffBJzcrOw==",
+    "node_modules/@biomejs/biome/node_modules/@biomejs/cli-linux-arm64": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-arm64/-/cli-linux-arm64-2.2.0.tgz",
+      "integrity": "sha512-6eoRdF2yW5FnW9Lpeivh7Mayhq0KDdaDMYOJnH9aT02KuSIX5V1HmWJCQQPwIQbhDh68Zrcpl8inRlTEan0SXw==",
       "cpu": [
-        "x64"
+        "arm64"
       ],
       "dev": true,
       "license": "MIT OR Apache-2.0",
       "optional": true,
       "os": [
-        "darwin"
+        "linux"
       ],
       "engines": {
         "node": ">=14.21.3"
       }
     },
-    "node_modules/@biomejs/cli-linux-arm64": {
-      "version": "2.1.4",
-      "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-arm64/-/cli-linux-arm64-2.1.4.tgz",
-      "integrity": "sha512-juhEkdkKR4nbUi5k/KRp1ocGPNWLgFRD4NrHZSveYrD6i98pyvuzmS9yFYgOZa5JhaVqo0HPnci0+YuzSwT2fw==",
+    "node_modules/@biomejs/biome/node_modules/@biomejs/cli-linux-arm64-musl": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-arm64-musl/-/cli-linux-arm64-musl-2.2.0.tgz",
+      "integrity": "sha512-egKpOa+4FL9YO+SMUMLUvf543cprjevNc3CAgDNFLcjknuNMcZ0GLJYa3EGTCR2xIkIUJDVneBV3O9OcIlCEZQ==",
       "cpu": [
         "arm64"
       ],
@@ -103,12 +101,12 @@
         "node": ">=14.21.3"
       }
     },
-    "node_modules/@biomejs/cli-linux-arm64-musl": {
-      "version": "2.1.4",
-      "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-arm64-musl/-/cli-linux-arm64-musl-2.1.4.tgz",
-      "integrity": "sha512-nYr7H0CyAJPaLupFE2cH16KZmRC5Z9PEftiA2vWxk+CsFkPZQ6dBRdcC6RuS+zJlPc/JOd8xw3uCCt9Pv41WvQ==",
+    "node_modules/@biomejs/biome/node_modules/@biomejs/cli-linux-x64": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-x64/-/cli-linux-x64-2.2.0.tgz",
+      "integrity": "sha512-5UmQx/OZAfJfi25zAnAGHUMuOd+LOsliIt119x2soA2gLggQYrVPA+2kMUxR6Mw5M1deUF/AWWP2qpxgH7Nyfw==",
       "cpu": [
-        "arm64"
+        "x64"
       ],
       "dev": true,
       "license": "MIT OR Apache-2.0",
@@ -120,10 +118,10 @@
         "node": ">=14.21.3"
       }
     },
-    "node_modules/@biomejs/cli-linux-x64": {
-      "version": "2.1.4",
-      "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-x64/-/cli-linux-x64-2.1.4.tgz",
-      "integrity": "sha512-Eoy9ycbhpJVYuR+LskV9s3uyaIkp89+qqgqhGQsWnp/I02Uqg2fXFblHJOpGZR8AxdB9ADy87oFVxn9MpFKUrw==",
+    "node_modules/@biomejs/biome/node_modules/@biomejs/cli-linux-x64-musl": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-x64-musl/-/cli-linux-x64-musl-2.2.0.tgz",
+      "integrity": "sha512-I5J85yWwUWpgJyC1CcytNSGusu2p9HjDnOPAFG4Y515hwRD0jpR9sT9/T1cKHtuCvEQ/sBvx+6zhz9l9wEJGAg==",
       "cpu": [
         "x64"
       ],
@@ -137,29 +135,29 @@
         "node": ">=14.21.3"
       }
     },
-    "node_modules/@biomejs/cli-linux-x64-musl": {
-      "version": "2.1.4",
-      "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-x64-musl/-/cli-linux-x64-musl-2.1.4.tgz",
-      "integrity": "sha512-lvwvb2SQQHctHUKvBKptR6PLFCM7JfRjpCCrDaTmvB7EeZ5/dQJPhTYBf36BE/B4CRWR2ZiBLRYhK7hhXBCZAg==",
+    "node_modules/@biomejs/biome/node_modules/@biomejs/cli-win32-arm64": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-win32-arm64/-/cli-win32-arm64-2.2.0.tgz",
+      "integrity": "sha512-n9a1/f2CwIDmNMNkFs+JI0ZjFnMO0jdOyGNtihgUNFnlmd84yIYY2KMTBmMV58ZlVHjgmY5Y6E1hVTnSRieggA==",
       "cpu": [
-        "x64"
+        "arm64"
       ],
       "dev": true,
       "license": "MIT OR Apache-2.0",
       "optional": true,
       "os": [
-        "linux"
+        "win32"
       ],
       "engines": {
         "node": ">=14.21.3"
       }
     },
-    "node_modules/@biomejs/cli-win32-arm64": {
-      "version": "2.1.4",
-      "resolved": "https://registry.npmjs.org/@biomejs/cli-win32-arm64/-/cli-win32-arm64-2.1.4.tgz",
-      "integrity": "sha512-3WRYte7orvyi6TRfIZkDN9Jzoogbv+gSvR+b9VOXUg1We1XrjBg6WljADeVEaKTvOcpVdH0a90TwyOQ6ue4fGw==",
+    "node_modules/@biomejs/biome/node_modules/@biomejs/cli-win32-x64": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-win32-x64/-/cli-win32-x64-2.2.0.tgz",
+      "integrity": "sha512-Nawu5nHjP/zPKTIryh2AavzTc/KEg4um/MxWdXW0A6P/RZOyIpa7+QSjeXwAwX/utJGaCoXRPWtF3m5U/bB3Ww==",
       "cpu": [
-        "arm64"
+        "x64"
       ],
       "dev": true,
       "license": "MIT OR Apache-2.0",
@@ -171,27 +169,23 @@
         "node": ">=14.21.3"
       }
     },
-    "node_modules/@biomejs/cli-win32-x64": {
-      "version": "2.1.4",
-      "resolved": "https://registry.npmjs.org/@biomejs/cli-win32-x64/-/cli-win32-x64-2.1.4.tgz",
-      "integrity": "sha512-tBc+W7anBPSFXGAoQW+f/+svkpt8/uXfRwDzN1DvnatkRMt16KIYpEi/iw8u9GahJlFv98kgHcIrSsZHZTR0sw==",
+    "node_modules/@biomejs/cli-darwin-arm64": {
+      "version": "2.2.0",
       "cpu": [
-        "x64"
+        "arm64"
       ],
       "dev": true,
       "license": "MIT OR Apache-2.0",
       "optional": true,
       "os": [
-        "win32"
+        "darwin"
       ],
       "engines": {
         "node": ">=14.21.3"
       }
     },
     "node_modules/@types/node": {
-      "version": "24.2.1",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-24.2.1.tgz",
-      "integrity": "sha512-DRh5K+ka5eJic8CjH7td8QpYEV6Zo10gfRkjHCO3weqZHWDtAaSTFtl4+VMqOJ4N5jcuhZ9/l+yy8rVgw7BQeQ==",
+      "version": "24.3.0",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -200,8 +194,6 @@
     },
     "node_modules/@types/ws": {
       "version": "8.18.1",
-      "resolved": "https://registry.npmjs.org/@types/ws/-/ws-8.18.1.tgz",
-      "integrity": "sha512-ThVF6DCVhA8kUGy+aazFQ4kXQ7E1Ty7A3ypFOe0IcJV8O/M511G99AW24irKrW56Wt44yG9+ij8FaqoBGkuBXg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -210,8 +202,6 @@
     },
     "node_modules/base64-js": {
       "version": "1.5.1",
-      "resolved": "https://registry.npmjs.org/base64-js/-/base64-js-1.5.1.tgz",
-      "integrity": "sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==",
       "funding": [
         {
           "type": "github",
@@ -230,8 +220,6 @@
     },
     "node_modules/bl": {
       "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/bl/-/bl-4.1.0.tgz",
-      "integrity": "sha512-1W07cM9gS6DcLperZfFSj+bWLtaPGSOHWhPiGzXmvVJbRLdG82sH/Kn8EtW1VqWVA54AKf2h5k5BbnIbwF3h6w==",
       "license": "MIT",
       "dependencies": {
         "buffer": "^5.5.0",
@@ -241,8 +229,6 @@
     },
     "node_modules/buffer": {
       "version": "5.7.1",
-      "resolved": "https://registry.npmjs.org/buffer/-/buffer-5.7.1.tgz",
-      "integrity": "sha512-EHcyIPBQ4BSGlvjB16k5KgAJ27CIsHY/2JBmCRReo48y9rQ3MaUzWX3KVlBa4U7MyX02HdVj0K7C3WaB3ju7FQ==",
       "funding": [
         {
           "type": "github",
@@ -265,14 +251,10 @@
     },
     "node_modules/chownr": {
       "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/chownr/-/chownr-1.1.4.tgz",
-      "integrity": "sha512-jJ0bqzaylmJtVnNgzTeSOs8DPavpbYgEr/b0YL8/2GO3xJEhInFmhKMUnEJQjZumK7KXGFhUy89PrsJWlakBVg==",
       "license": "ISC"
     },
     "node_modules/decompress-response": {
       "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/decompress-response/-/decompress-response-6.0.0.tgz",
-      "integrity": "sha512-aW35yZM6Bb/4oJlZncMH2LCoZtJXTRxES17vE3hoRiowU2kWHaJKFkSBDnDR+cm9J+9QhXmREyIfv0pji9ejCQ==",
       "license": "MIT",
       "dependencies": {
         "mimic-response": "^3.1.0"
@@ -286,8 +268,6 @@
     },
     "node_modules/deep-extend": {
       "version": "0.6.0",
-      "resolved": "https://registry.npmjs.org/deep-extend/-/deep-extend-0.6.0.tgz",
-      "integrity": "sha512-LOHxIOaPYdHlJRtCQfDIVZtfw/ufM8+rVj649RIHzcm/vGwQRXFt6OPqIFWsm2XEMrNIEtWR64sY1LEKD2vAOA==",
       "license": "MIT",
       "engines": {
         "node": ">=4.0.0"
@@ -295,8 +275,6 @@
     },
     "node_modules/detect-libc": {
       "version": "2.0.4",
-      "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.0.4.tgz",
-      "integrity": "sha512-3UDv+G9CsCKO1WKMGw9fwq/SWJYbI0c5Y7LU1AXYoDdbhE2AHQ6N6Nb34sG8Fj7T5APy8qXDCKuuIHd1BR0tVA==",
       "license": "Apache-2.0",
       "engines": {
         "node": ">=8"
@@ -304,8 +282,6 @@
     },
     "node_modules/end-of-stream": {
       "version": "1.4.5",
-      "resolved": "https://registry.npmjs.org/end-of-stream/-/end-of-stream-1.4.5.tgz",
-      "integrity": "sha512-ooEGc6HP26xXq/N+GCGOT0JKCLDGrq2bQUZrQ7gyrJiZANJ/8YDTxTpQBXGMn+WbIQXNVpyWymm7KYVICQnyOg==",
       "license": "MIT",
       "dependencies": {
         "once": "^1.4.0"
@@ -313,8 +289,6 @@
     },
     "node_modules/expand-template": {
       "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/expand-template/-/expand-template-2.0.3.tgz",
-      "integrity": "sha512-XYfuKMvj4O35f/pOXLObndIRvyQ+/+6AhODh+OKWj9S9498pHHn/IMszH+gt0fBCRWMNfk1ZSp5x3AifmnI2vg==",
       "license": "(MIT OR WTFPL)",
       "engines": {
         "node": ">=6"
@@ -322,20 +296,14 @@
     },
     "node_modules/fs-constants": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/fs-constants/-/fs-constants-1.0.0.tgz",
-      "integrity": "sha512-y6OAwoSIf7FyjMIv94u+b5rdheZEjzR63GTyZJm5qh4Bi+2YgwLCcI/fPFZkL5PSixOt6ZNKm+w+Hfp/Bciwow==",
       "license": "MIT"
     },
     "node_modules/github-from-package": {
       "version": "0.0.0",
-      "resolved": "https://registry.npmjs.org/github-from-package/-/github-from-package-0.0.0.tgz",
-      "integrity": "sha512-SyHy3T1v2NUXn29OsWdxmK6RwHD+vkj3v8en8AOBZ1wBQ/hCAQ5bAQTD02kW4W9tUp/3Qh6J8r9EvntiyCmOOw==",
       "license": "MIT"
     },
     "node_modules/ieee754": {
       "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/ieee754/-/ieee754-1.2.1.tgz",
-      "integrity": "sha512-dcyqhDvX1C46lXZcVqCpK+FtMRQVdIMN6/Df5js2zouUsqG7I6sFxitIC+7KYK29KdXOLHdu9zL4sFnoVQnqaA==",
       "funding": [
         {
           "type": "github",
@@ -354,20 +322,14 @@
     },
     "node_modules/inherits": {
       "version": "2.0.4",
-      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
-      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
       "license": "ISC"
     },
     "node_modules/ini": {
       "version": "1.3.8",
-      "resolved": "https://registry.npmjs.org/ini/-/ini-1.3.8.tgz",
-      "integrity": "sha512-JV/yugV2uzW5iMRSiZAyDtQd+nxtUnjeLt0acNdw98kKLrvuRVyB80tsREOE7yvGVgalhZ6RNXCmEHkUKBKxew==",
       "license": "ISC"
     },
     "node_modules/mimic-response": {
       "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/mimic-response/-/mimic-response-3.1.0.tgz",
-      "integrity": "sha512-z0yWI+4FDrrweS8Zmt4Ej5HdJmky15+L2e6Wgn3+iK5fWzb6T3fhNFq2+MeTRb064c6Wr4N/wv0DzQTjNzHNGQ==",
       "license": "MIT",
       "engines": {
         "node": ">=10"
@@ -378,8 +340,6 @@
     },
     "node_modules/minimist": {
       "version": "1.2.8",
-      "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.8.tgz",
-      "integrity": "sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==",
       "license": "MIT",
       "funding": {
         "url": "https://github.com/sponsors/ljharb"
@@ -387,20 +347,14 @@
     },
     "node_modules/mkdirp-classic": {
       "version": "0.5.3",
-      "resolved": "https://registry.npmjs.org/mkdirp-classic/-/mkdirp-classic-0.5.3.tgz",
-      "integrity": "sha512-gKLcREMhtuZRwRAfqP3RFW+TK4JqApVBtOIftVgjuABpAtpxhPGaDcfvbhNvD0B8iD1oUr/txX35NjcaY6Ns/A==",
       "license": "MIT"
     },
     "node_modules/napi-build-utils": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/napi-build-utils/-/napi-build-utils-2.0.0.tgz",
-      "integrity": "sha512-GEbrYkbfF7MoNaoh2iGG84Mnf/WZfB0GdGEsM8wz7Expx/LlWf5U8t9nvJKXSp3qr5IsEbK04cBGhol/KwOsWA==",
       "license": "MIT"
     },
     "node_modules/node-abi": {
       "version": "3.75.0",
-      "resolved": "https://registry.npmjs.org/node-abi/-/node-abi-3.75.0.tgz",
-      "integrity": "sha512-OhYaY5sDsIka7H7AtijtI9jwGYLyl29eQn/W623DiN/MIv5sUqc4g7BIDThX+gb7di9f6xK02nkp8sdfFWZLTg==",
       "license": "MIT",
       "dependencies": {
         "semver": "^7.3.5"
@@ -411,8 +365,6 @@
     },
     "node_modules/node-datachannel": {
       "version": "0.29.0",
-      "resolved": "https://registry.npmjs.org/node-datachannel/-/node-datachannel-0.29.0.tgz",
-      "integrity": "sha512-aCRJA5uZRqxMvQAl2QtOnCkodF1qJa1dCUVaXW9D7rku2p6F7PWe5OuRLcIgOYe+e2ZyJu0LefIQ95TtCn6xxA==",
       "hasInstallScript": true,
       "license": "MPL 2.0",
       "dependencies": {
@@ -424,8 +376,6 @@
     },
     "node_modules/once": {
       "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
-      "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
       "license": "ISC",
       "dependencies": {
         "wrappy": "1"
@@ -433,8 +383,6 @@
     },
     "node_modules/prebuild-install": {
       "version": "7.1.3",
-      "resolved": "https://registry.npmjs.org/prebuild-install/-/prebuild-install-7.1.3.tgz",
-      "integrity": "sha512-8Mf2cbV7x1cXPUILADGI3wuhfqWvtiLA1iclTDbFRZkgRQS0NqsPZphna9V+HyTEadheuPmjaJMsbzKQFOzLug==",
       "license": "MIT",
       "dependencies": {
         "detect-libc": "^2.0.0",
@@ -459,8 +407,6 @@
     },
     "node_modules/pump": {
       "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/pump/-/pump-3.0.3.tgz",
-      "integrity": "sha512-todwxLMY7/heScKmntwQG8CXVkWUOdYxIvY2s0VWAAMh/nd8SoYiRaKjlr7+iCs984f2P8zvrfWcDDYVb73NfA==",
       "license": "MIT",
       "dependencies": {
         "end-of-stream": "^1.1.0",
@@ -469,8 +415,6 @@
     },
     "node_modules/rc": {
       "version": "1.2.8",
-      "resolved": "https://registry.npmjs.org/rc/-/rc-1.2.8.tgz",
-      "integrity": "sha512-y3bGgqKj3QBdxLbLkomlohkvsA8gdAiUQlSBJnBhfn+BPxg4bc62d8TcBW15wavDfgexCgccckhcZvywyQYPOw==",
       "license": "(BSD-2-Clause OR MIT OR Apache-2.0)",
       "dependencies": {
         "deep-extend": "^0.6.0",
@@ -484,8 +428,6 @@
     },
     "node_modules/readable-stream": {
       "version": "3.6.2",
-      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-3.6.2.tgz",
-      "integrity": "sha512-9u/sniCrY3D5WdsERHzHE4G2YCXqoG5FTHUiCC4SIbr6XcLZBY05ya9EKjYek9O5xOAwjGq+1JdGBAS7Q9ScoA==",
       "license": "MIT",
       "dependencies": {
         "inherits": "^2.0.3",
@@ -498,8 +440,6 @@
     },
     "node_modules/safe-buffer": {
       "version": "5.2.1",
-      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz",
-      "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==",
       "funding": [
         {
           "type": "github",
@@ -518,8 +458,6 @@
     },
     "node_modules/semver": {
       "version": "7.7.2",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.2.tgz",
-      "integrity": "sha512-RF0Fw+rO5AMf9MAyaRXI4AV0Ulj5lMHqVxxdSgiVbixSCXoEmmX/jk0CuJw4+3SqroYO9VoUh+HcuJivvtJemA==",
       "license": "ISC",
       "bin": {
         "semver": "bin/semver.js"
@@ -530,8 +468,6 @@
     },
     "node_modules/simple-concat": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/simple-concat/-/simple-concat-1.0.1.tgz",
-      "integrity": "sha512-cSFtAPtRhljv69IK0hTVZQ+OfE9nePi/rtJmw5UjHeVyVroEqJXP1sFztKUy1qU+xvz3u/sfYJLa947b7nAN2Q==",
       "funding": [
         {
           "type": "github",
@@ -550,8 +486,6 @@
     },
     "node_modules/simple-get": {
       "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/simple-get/-/simple-get-4.0.1.tgz",
-      "integrity": "sha512-brv7p5WgH0jmQJr1ZDDfKDOSeWWg+OVypG99A/5vYGPqJ6pxiaHLy8nxtFjBA7oMa01ebA9gfh1uMCFqOuXxvA==",
       "funding": [
         {
           "type": "github",
@@ -575,8 +509,6 @@
     },
     "node_modules/string_decoder": {
       "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.3.0.tgz",
-      "integrity": "sha512-hkRX8U1WjJFd8LsDJ2yQ/wWWxaopEsABU1XfkM8A+j0+85JAGppt16cr1Whg6KIbb4okU6Mql6BOj+uup/wKeA==",
       "license": "MIT",
       "dependencies": {
         "safe-buffer": "~5.2.0"
@@ -584,8 +516,6 @@
     },
     "node_modules/strip-json-comments": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-2.0.1.tgz",
-      "integrity": "sha512-4gB8na07fecVVkOI6Rs4e7T6NOTki5EmL7TUduTs6bu3EdnSycntVJ4re8kgZA+wx9IueI2Y11bfbgwtzuE0KQ==",
       "license": "MIT",
       "engines": {
         "node": ">=0.10.0"
@@ -593,8 +523,6 @@
     },
     "node_modules/tar-fs": {
       "version": "2.1.3",
-      "resolved": "https://registry.npmjs.org/tar-fs/-/tar-fs-2.1.3.tgz",
-      "integrity": "sha512-090nwYJDmlhwFwEW3QQl+vaNnxsO2yVsd45eTKRBzSzu+hlb1w2K9inVq5b0ngXuLVqQ4ApvsUHHnu/zQNkWAg==",
       "license": "MIT",
       "dependencies": {
         "chownr": "^1.1.1",
@@ -605,8 +533,6 @@
     },
     "node_modules/tar-stream": {
       "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/tar-stream/-/tar-stream-2.2.0.tgz",
-      "integrity": "sha512-ujeqbceABgwMZxEJnk2HDY2DlnUZ+9oEcb1KzTVfYHio0UE6dG71n60d8D2I4qNvleWrrXpmjpt7vZeF1LnMZQ==",
       "license": "MIT",
       "dependencies": {
         "bl": "^4.0.3",
@@ -621,8 +547,6 @@
     },
     "node_modules/tunnel-agent": {
       "version": "0.6.0",
-      "resolved": "https://registry.npmjs.org/tunnel-agent/-/tunnel-agent-0.6.0.tgz",
-      "integrity": "sha512-McnNiV1l8RYeY8tBgEpuodCC1mLUdbSN+CYBL7kJsJNInOP8UjDDEwdk6Mw60vdLLrr5NHKZhMAOSrR2NZuQ+w==",
       "license": "Apache-2.0",
       "dependencies": {
         "safe-buffer": "^5.0.1"
@@ -633,8 +557,6 @@
     },
     "node_modules/typescript": {
       "version": "5.9.2",
-      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.2.tgz",
-      "integrity": "sha512-CWBzXQrc/qOkhidw1OzBTQuYRbfyxDXJMVJ1XNwUHGROVmuaeiEm3OslpZ1RV96d7SKKjZKrSJu3+t/xlw3R9A==",
       "dev": true,
       "license": "Apache-2.0",
       "bin": {
@@ -647,27 +569,19 @@
     },
     "node_modules/undici-types": {
       "version": "7.10.0",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.10.0.tgz",
-      "integrity": "sha512-t5Fy/nfn+14LuOc2KNYg75vZqClpAiqscVvMygNnlsHBFpSXdJaYtXMcdNLpl/Qvc3P2cB3s6lOV51nqsFq4ag==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/util-deprecate": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz",
-      "integrity": "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==",
       "license": "MIT"
     },
     "node_modules/wrappy": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
-      "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==",
       "license": "ISC"
     },
     "node_modules/ws": {
       "version": "8.18.3",
-      "resolved": "https://registry.npmjs.org/ws/-/ws-8.18.3.tgz",
-      "integrity": "sha512-PEIGCY5tSlUt50cqyMXfCzX+oOPqN0vuGqWzbcJ2xvnkzkq46oOpz7dQaTDBdfICb4N14+GARUDw2XV2N4tvzg==",
       "license": "MIT",
       "engines": {
         "node": ">=10.0.0"
diff --git a/src/types.ts b/src/types.ts
index cd2e5e6..7f7547a 100644
--- a/src/types.ts
+++ b/src/types.ts
@@ -142,6 +142,7 @@ export interface Connection {
 export interface WebSocketMessage {
   type:
     | 'auth'
+    | 'auth_challenge'
     | 'auth_success'
     | 'error'
     | 'webrtc_offer'
@@ -155,7 +156,12 @@ export interface WebSocketMessage {
     | 'pong'
     | 'log';
   role?: 'appender' | 'reader';
-  key?: string;
+  // Zero-knowledge auth fields
+  proof?: string;
+  nonce?: string;
+  timestamp?: number;
+  algo?: 'hmac-sha256';
+  version?: 'v1';
   /** Default fields included with all logs for this session. */
   defaultFields?: Record<string, unknown>;
   /** Optional log payload when using log-level signaling. */
diff --git a/src/webrtc-connection.ts b/src/webrtc-connection.ts
index 2b33b01..92187bd 100644
--- a/src/webrtc-connection.ts
+++ b/src/webrtc-connection.ts
@@ -9,6 +9,7 @@
  */
 
 import * as nodeDataChannel from 'node-datachannel';
+import { createHmac } from 'crypto';
 import { WebSocket } from 'ws';
 import type {
   ConnectionInfo,
@@ -47,6 +48,8 @@ export interface WebRTCManagerState {
   signalingWs: WebSocket | null;
   myPeerId: string | null;
   myRole: 'appender' | 'reader' | null;
+  myPublicToken: string | null;
+  myKeyHex: string | null;
   peers: Map<string, PeerInfo>;
   rtcConnections: Map<string, RTCConnection>;
   logHandlers: Set<(logData: LogData) => void>;
@@ -55,6 +58,7 @@ export interface WebRTCManagerState {
   cleanupInterval: NodeJS.Timeout | null;
   reconnectionAttempts: number;
   maxReconnectionAttempts: number;
+  defaultFields?: Record<string, unknown>;
 }
 
 /**
@@ -77,6 +81,8 @@ function createWebRTCManagerState(): WebRTCManagerState {
     signalingWs: null,
     myPeerId: null,
     myRole: null,
+    myPublicToken: null,
+    myKeyHex: null,
     peers: new Map(),
     rtcConnections: new Map(),
     logHandlers: new Set(),
@@ -382,6 +388,14 @@ export function WebRTCManager(): WebRTCManager {
     async connect(connectionString: string, defaultFields?: Record<string, unknown>): Promise<void> {
       const { host, role, key, publicToken } = parseConnectionString(connectionString);
       state.myRole = role;
+      state.myPublicToken = publicToken || null;
+      state.myKeyHex = key;
+      // Respect exactOptionalPropertyTypes: delete property when undefined
+      if (defaultFields === undefined) {
+        delete (state as { defaultFields?: Record<string, unknown> }).defaultFields;
+      } else {
+        state.defaultFields = defaultFields;
+      }
 
       return new Promise((resolve, reject) => {
         try {
@@ -398,19 +412,7 @@ export function WebRTCManager(): WebRTCManager {
           state.signalingWs = new WebSocket(wsUrl, wsOptions);
 
           state.signalingWs.on('open', () => {
-            // Send authentication message with defaultFields
-            const authMessage: WebSocketMessage = {
-              type: 'auth',
-              role,
-              key,
-            };
-
-            // Include defaultFields if provided
-            if (defaultFields && Object.keys(defaultFields).length > 0) {
-              authMessage.defaultFields = defaultFields;
-            }
-
-            sendMessage(state, authMessage);
+            // Wait for auth_challenge before sending proof
           });
 
           state.signalingWs.on('message', (data: Buffer) => {
@@ -518,6 +520,25 @@ function handleMessage(
   reject?: (reason: Error) => void
 ): void {
   switch (message.type) {
+    case 'auth_challenge': {
+      const { nonce, timestamp } = message as unknown as { nonce: string; timestamp: number };
+      if (!state.myRole || !state.myPublicToken || !state.myKeyHex) {
+        console.error('Missing connection details for auth proof');
+        return;
+      }
+      const payload = `openpull-auth|v1|${state.myPublicToken}|${state.myRole}|${nonce}|${timestamp}`;
+      const proof = createHmac('sha256', Buffer.from(state.myKeyHex, 'hex')).update(payload).digest('hex');
+      const authMessage: WebSocketMessage = {
+        type: 'auth',
+        role: state.myRole,
+        proof,
+      };
+      if (state.defaultFields && Object.keys(state.defaultFields).length > 0) {
+        authMessage.defaultFields = state.defaultFields;
+      }
+      sendMessage(state, authMessage);
+      break;
+    }
     case 'auth_success':
       state.myPeerId = message.peerId!;
       console.log(`Authenticated as ${state.myRole} with peerId: ${state.myPeerId}`);