Identity plugin · listing tai42/identity-redisInstall
Permissions
Provides
redis
Identity — Redis-backed api-key identity provider — validate inbound tokens and provision keys.
This is the default identity provider: it stores api-key hashes in Redis,
validates inbound tokens, and provisions and revokes keys. Access control is on
by default and the runtime refuses to boot with no identity provider registered,
so this plugin is the pairing every access-controlled install starts from.
Register and select it
manifest.yml
redis provider at import.
ACCESS_CONTROL_AUTH_PROVIDERS (an ordered JSON list) names the chain the verifier
tries. Unset, the chain is every registered identity provider, sorted by name.
Configuration
The provider owns its key store, so it reads its Redis connection and key namespace from its ownTAI_IDENTITY_ env group. The access-control gate keeps its own Redis,
ACCESS_CONTROL_REDIS_URL, for policies, per-user live counters and the setup token.
Any standard
redis-server works — no RedisJSON module or redis-stack image is
required.
Initialize the deployment
A fresh install has no principal and no key, andtai keys create authenticates
with one — so the deployment is initialized through the public, one-shot
POST /api/setup door. It creates the owner principal (an admin), mints the
owner’s first key, and returns the raw sk-… key once. It is gated by a
boot-time token: set TAI_SETUP_TOKEN, or let the platform auto-generate one and
read it from the startup log (setup token: …). The door refuses with 409 Already initialized once any principal exists.
sk-… owner key is printed once — capture it then. Pass - to read the
setup token from stdin, keeping the secret off the command line. A keys-only
install (this provider with no accounts provider) sends no login; when an
accounts provider that attaches interactive logins is configured, the owner’s
login is attached in the same call.
Provision more keys
With the owner key in hand, mint further keys the normal way — the rawsk-…
value is printed once.
See also
- Access control — the policy model and the verifier chain.
- Set up access control — minting the first key and mapping routes to scopes.