eve-auth-and-secrets

Eve Auth and Secrets

Use this workflow to log in to Eve and manage secrets for your app.

When to Use

• Setting up a new project profile
• Authentication failures
• Adding or rotating secrets
• Secret interpolation errors during deploys
• Setting up identity providers or org invites
• Adding SSO login to an Eve-deployed app
• Setting up access groups and scoped data-plane authorization
• Configuring group-aware RLS for environment databases

Authentication

eve auth login
eve auth login --ttl 30                # custom token TTL (1-90 days)
eve auth status

Challenge-Response Flow

Eve uses challenge-response authentication. The default provider is github_ssh:

1. Client sends SSH public key fingerprint
2. Server returns a challenge (random bytes)
3. Client signs the challenge with the private key
4. Server verifies the signature and issues a JWT

Token Types

Type	Issued Via	Use Case
User Token	eve auth login	Interactive CLI sessions
Job Token	Worker auto-issued	Agent execution within jobs
Minted Token	eve auth mint	Bot/service accounts

JWT payloads include sub (user ID), org_id, scope, and exp. Verify tokens via the JWKS endpoint: GET /auth/jwks.

Role and org membership changes take effect immediately -- the server resolves permissions from live DB memberships, not stale JWT claims. When a request includes a project_id but no org_id, the permission guard derives the org context from the project's owning org.

Permissions

Check what the current token can do:

eve auth permissions

Register additional identities for multi-provider access:

curl -X POST "$EVE_API_URL/auth/identities" -H "Authorization: Bearer $TOKEN" \
  -d '{"provider": "nostr", "external_id": "<pubkey>"}'

Identity Providers

Eve supports pluggable identity providers. The auth guard tries Bearer JWT first, then provider-specific request auth.

Provider	Auth Method	Use Case
github_ssh	SSH challenge-response	Default CLI login
nostr	NIP-98 request auth + challenge-response	Nostr-native users