PRX Identity

Centralized OAuth and signed identity tokens for PRX infrastructure. Issues a stable opaque UUID per subject; Security gates access on that UUID.

Live v0.0.0 · 2026-08-31T01:45:35.523Z /healthz JSON

Active signing key Live · M2

Health endpoint Live · M0 GET /healthz — JSON heartbeat.
User-facing pages Live · M1 Sign-in, account, admin, lookup — server-rendered HTML.
Public signing keys Live · M2 GET /jwks.json — Ed25519 keys consumers use to verify tokens offline.
OIDC discovery Live · M2 GET /.well-known/openid-configuration.
Google sign-in Live · M3 Federated sign-in via Google.
Microsoft sign-in Live · M3 Federated sign-in via Microsoft.

Identity token issue (humans) M4 POST /token authorization_code grant; returns signed JWT.
prx.is integration M5 prx.is uses Identity for sign-in; existing users backfilled.
Service identities M6 Registered Ed25519 keypairs for CLIs, cron, and internal scripts.
Identity token issue (services) M6 POST /token client_credentials with JWT-bearer client assertion.
Apple sign-in M7 Federated sign-in via Apple.
Attribute lookup M7 GET /lookup/<uuid> — mutable attributes (display_name, last-known email).

M0 — Repo bootstrap
Fastify + TS scaffolding, /healthz endpoint, lint + typecheck + test wiring.

Live
M1 — UI scaffolding
Server-rendered pages for sign-in, account, service-identity admin, and lookup. Each surface labeled with the milestone that makes it real, so the UI doubles as a product spec.

Live
M2 — Schema + signing keys + JWKS
MySQL schema (5 tables), Ed25519 signing key under SysOps custody, /jwks.json and /.well-known/openid-configuration go live.

Live
M3 — OAuth federation (Google + Microsoft)
/authorize and /callback/:provider with real provider redirects. Identity-side session cookie. Admin UI at /admin/oauth-clients to enter provider client_id + client_secret. Wires the M1 sign-in stubs.

Live
M4 — /token authcode grant
Sign and return the 6-claim JWT for human flows. Audience-bound, ~5-minute TTL, offline JWS verification.

Pending
M5 — prx.is integration
prx.is redirects to id.prx.is, verifies the returned token, links to local users.id via a new identity_link table; backfills existing prx.is users.

Pending
M6 — Service / agent identities
identity_service_keys table, provisioning CLI, /token client-credentials grant via JWT-bearer client assertion. Enables intranet CLIs, cron, and internal scripts.

Pending
M7 — Apple OAuth + /lookup
Apple OIDC federation. /lookup/<uuid> endpoint for mutable attributes (display_name, last-known email).

Pending

Service redirects the user to /authorize.
Identity federates to Google / Microsoft / Apple, gets back a verified email.
Identity looks up or creates a stable UUID for the user.
Identity hands the service an authcode; the service exchanges it at /token for a signed JWT.
Service verifies the JWT signature against /jwks.json (cached locally; offline check). Trusts sub, ignores everything mutable.
Service creates its own session cookie, scoped to its own domain. Identity never sees that cookie.