Identity & Authentication
One self-hosted identity every Runline app authenticates against, org-scoped per CU.
Identity is backbone infrastructure. Per ADR-013 §0, three things are always Runline-centralized with no exception: identity, DNS, and the vault. Everything else can move toward a CU; these don't.
One identity service, everything authenticates against it
Runline runs one self-hosted Better Auth instance (identity.runline.run). Every Runline product authenticates against it rather than rolling its own, and it issues OIDC tokens to the downstream apps (Client Hub, Arc). It's org-scoped multi-tenant: one org per CU, so one credit union's members can't see another's.
| Who | How they authenticate |
|---|---|
| CU staff (humans) | Magic link + Google OAuth today; org-level SSO when the CU is ready. |
| Agents (service-to-service) | Minted API keys / agent tokens. A key needs a real session to create, not just a userId. |
| Downstream apps | OIDC tokens issued by identity, consumed by Arc, Client Hub, and the Grid. |
The auth paths
The platform supports more than one path to a trusted identity (ADR-004):
- Device pairing (internal / agents): identity is a cryptographic keypair, zero-knowledge, device-bound. Frictionless for developers and containerized Runners.
- Federated login (CU employees): magic link now, upgrading to the CU's own SSO with no re-onboarding.
- Agent tokens (headless managed runtime): an
arc_agent_token per(agent, org), SHA-256 hashed at rest, issued and revocable by admins. Managed Runners like Sentinel and Joy run on this path.
Under the hood the model is layered: an Identity (human or agent) sits above an Account (the trust anchor), which has Bindings to the machines it runs on. Identity-scoped tokens enable a unified view across every org an identity touches.
Isolation is the point
Org-scoping isn't a feature flag, it's the tenancy boundary. One CU's members, data, and Runners are walled from another's by construction (ADR-013). Secrets live in OpenBao, the centralized vault half of the backbone. Every authenticated action is telemetered and audited (the same audit trail the Grid enforces), which is how identity maps onto NCUA's who-did-what-when requirements.
Trust also compounds over time: a Runner earns autonomy through the trust tiers rather than starting with it.
Canonical reference
- Platform Services · Identity: the service, deploy, and dependencies
- Platform Services · OpenBao: the centralized vault
- ADR-004 · Identity Architecture: the full two-path design
- ADR-013 · Tenant Isolation Architecture: why identity/DNS/vault stay centralized