Skip to content
tcpsystems
Version: Current

auth: Pocket ID status

import StatusPill from ‘../../../components/StatusPill.astro’;

Pocket ID is the identity provider for estate surfaces, passkey first, with one client per realm. Auth answers 401 or 403 by default. It fails closed: when a client, a realm or a signing key is missing, the answer is a refusal, not an anonymous session. No identity or single sign-on feature is gated behind a plan.

Liveness

Section titled “Liveness”

On 2026-11-05 a read-only probe answered 200 for both the host root and the discovery document (https://auth.tcp.systems/.well-known/openid-configuration), with the issuer field exactly https://auth.tcp.systems. Clients must read endpoints from that document, never from hard-coded paths. The dated probe is a snapshot; the status page carries the current state. The authenticated login round-trip is not part of this probe and is still BLOCKED on owner-held client registration (see below).

Sessions and failures

Section titled “Sessions and failures”

An owner passkey login against studio was reported as verified on 2026-11-02 (historical observation). Studio is dead until restored (owner update 2026-11-05), so do not treat that observation as current availability. If a sign in fails on any live surface, return or inspect the failure class: unknown client, expired session, or rejected assertion.

Operator boundary

Section titled “Operator boundary”
  • One client per realm. A surface is registered as a confidential client with an exact redirect URI and PKCE enabled. The live console callback is https://ai.tcp.systems/console/auth/callback.
  • Registration is tailnet-only. The admin UI answers 404 outside the tailnet. Clients are registered there, or through the admin API with an API key sent in a header. The generated client id and secret go straight into the consumer’s secret store and nowhere else.
  • Secrets by name only. The console OIDC configuration is OIDC_ISSUER, OIDC_CLIENT_ID, OIDC_REDIRECT_URI and a client secret held as a deploy secret (AUTH_CLIENT_SECRET in the console’s Worker configuration). Values never appear in documentation, tickets or logs. The authenticated login round-trip was still blocked on owner-held client registration when the live runbook was verified on 2026-10-30.
  • Read-only verification. tools/verify-pocketid-oidc.sh in the tcpsystems/auth repository re-probes discovery, JWKS and the hardening checks without a credential. Its BLOCKED section (an authenticated round-trip) needs an owner-held client and is not run from here.

The live runbook (docs/CONSOLE-OIDC-LIVE.md) and the relying-party contract (docs/CONSOLE-OIDC-CONTRACT.md) live in tcpsystems/auth; they are the deep operations record this page summarises.

Where to next

Section titled “Where to next”