[{"data":1,"prerenderedAt":1276},["ShallowReactive",2],{"navigation_docs":3,"-guide-going-further-signing-keys":587,"-guide-going-further-signing-keys-surround":1271},[4,50,155,441,504],{"title":5,"icon":6,"path":7,"stem":8,"children":9,"page":49},"Get Started","i-lucide-rocket","\u002Fget-started","1.get-started",[10,15,20,25,30,35,40,45],{"title":11,"path":12,"stem":13,"icon":14},"Introduction","\u002Fget-started\u002Fintroduction","1.get-started\u002F1.introduction","i-lucide-house",{"title":16,"path":17,"stem":18,"icon":19},"Installation","\u002Fget-started\u002Finstallation","1.get-started\u002F2.installation","i-lucide-download",{"title":21,"path":22,"stem":23,"icon":24},"Project structure","\u002Fget-started\u002Fproject-structure","1.get-started\u002F3.project-structure","i-lucide-folder-tree",{"title":26,"path":27,"stem":28,"icon":29},"Configuration","\u002Fget-started\u002Fconfiguration","1.get-started\u002F4.configuration","i-lucide-settings",{"title":31,"path":32,"stem":33,"icon":34},"Authentication","\u002Fget-started\u002Fauthentication","1.get-started\u002F5.authentication","i-lucide-lock",{"title":36,"path":37,"stem":38,"icon":39},"Adding modules","\u002Fget-started\u002Fadding-modules","1.get-started\u002F6.adding-modules","i-lucide-puzzle",{"title":41,"path":42,"stem":43,"icon":44},"Database","\u002Fget-started\u002Fdatabase","1.get-started\u002F7.database","i-lucide-database",{"title":46,"path":47,"stem":48,"icon":6},"Deployment","\u002Fget-started\u002Fdeployment","1.get-started\u002F8.deployment",false,{"title":51,"icon":52,"path":53,"stem":54,"children":55,"page":49},"Guide","i-lucide-book-open","\u002Fguide","2.guide",[56,90,115,125],{"title":57,"icon":49,"path":58,"stem":59,"children":60,"page":49},"Concepts","\u002Fguide\u002Fconcepts","2.guide\u002F1.concepts",[61,66,71,76,80,85],{"title":62,"path":63,"stem":64,"icon":65},"Architecture","\u002Fguide\u002Fconcepts\u002Farchitecture","2.guide\u002F1.concepts\u002F1.architecture","i-lucide-blocks",{"title":67,"path":68,"stem":69,"icon":70},"Access control","\u002Fguide\u002Fconcepts\u002Fauth-and-scopes","2.guide\u002F1.concepts\u002F2.auth-and-scopes","i-lucide-shield-check",{"title":72,"path":73,"stem":74,"icon":75},"Extension points","\u002Fguide\u002Fconcepts\u002Fextension-points","2.guide\u002F1.concepts\u002F3.extension-points","i-lucide-plug",{"title":77,"path":78,"stem":79,"icon":44},"Database extensions","\u002Fguide\u002Fconcepts\u002Fdatabase-extensions","2.guide\u002F1.concepts\u002F4.database-extensions",{"title":81,"path":82,"stem":83,"icon":84},"Identity","\u002Fguide\u002Fconcepts\u002Fidentity","2.guide\u002F1.concepts\u002F5.identity","i-lucide-fingerprint",{"title":86,"path":87,"stem":88,"icon":89},"Glossary","\u002Fguide\u002Fconcepts\u002Fglossary","2.guide\u002F1.concepts\u002F6.glossary","i-lucide-book-a",{"title":91,"icon":49,"path":92,"stem":93,"children":94,"page":49},"UX patterns","\u002Fguide\u002Fux-patterns","2.guide\u002F2.ux-patterns",[95,100,105,110],{"title":96,"path":97,"stem":98,"icon":99},"Layouts and navigation","\u002Fguide\u002Fux-patterns\u002Flayouts-and-navigation","2.guide\u002F2.ux-patterns\u002F1.layouts-and-navigation","i-lucide-layout-template",{"title":101,"path":102,"stem":103,"icon":104},"Pages","\u002Fguide\u002Fux-patterns\u002Fpages","2.guide\u002F2.ux-patterns\u002F2.pages","i-lucide-table",{"title":106,"path":107,"stem":108,"icon":109},"Forms and actions","\u002Fguide\u002Fux-patterns\u002Fforms-and-actions","2.guide\u002F2.ux-patterns\u002F3.forms-and-actions","i-lucide-square-pen",{"title":111,"path":112,"stem":113,"icon":114},"Text and formatting","\u002Fguide\u002Fux-patterns\u002Ftext-and-formatting","2.guide\u002F2.ux-patterns\u002F4.text-and-formatting","i-lucide-type",{"title":116,"icon":49,"path":117,"stem":118,"children":119,"page":49},"Best practices","\u002Fguide\u002Fbest-practices","2.guide\u002F3.best-practices",[120],{"title":121,"path":122,"stem":123,"icon":124},"HTTP routes","\u002Fguide\u002Fbest-practices\u002Fhttp-routes","2.guide\u002F3.best-practices\u002F1.http-routes","i-lucide-route",{"title":126,"icon":49,"path":127,"stem":128,"children":129,"page":49},"Going further","\u002Fguide\u002Fgoing-further","2.guide\u002F4.going-further",[130,135,140,145,150],{"title":131,"path":132,"stem":133,"icon":134},"Use your own OAuth server","\u002Fguide\u002Fgoing-further\u002Fown-oauth-server","2.guide\u002F4.going-further\u002F1.own-oauth-server","i-lucide-key-round",{"title":136,"path":137,"stem":138,"icon":139},"Create an OAuth application","\u002Fguide\u002Fgoing-further\u002Foauth-application","2.guide\u002F4.going-further\u002F2.oauth-application","i-lucide-app-window",{"title":141,"path":142,"stem":143,"icon":144},"Signing keys","\u002Fguide\u002Fgoing-further\u002Fsigning-keys","2.guide\u002F4.going-further\u002F3.signing-keys","i-lucide-key-square",{"title":146,"path":147,"stem":148,"icon":149},"Stripe setup","\u002Fguide\u002Fgoing-further\u002Fstripe-setup","2.guide\u002F4.going-further\u002F4.stripe-setup","i-lucide-credit-card",{"title":151,"path":152,"stem":153,"icon":154},"Migrate to the permission model","\u002Fguide\u002Fgoing-further\u002Fmigrate-access-control","2.guide\u002F4.going-further\u002F5.migrate-access-control","i-lucide-arrow-right-left",{"title":156,"icon":157,"path":158,"stem":159,"children":160},"Modules","i-lucide-boxes","\u002Fmodules","3.modules",[161,163,244,273,320,375],{"title":156,"path":158,"stem":162},"3.modules\u002Findex",{"title":81,"icon":49,"path":164,"stem":165,"children":166,"page":49},"\u002Fmodules\u002Fidentity","3.modules\u002F1.identity",[167,190,194,198,220,224,240],{"title":168,"path":169,"stem":170,"children":171},"Auth","\u002Fmodules\u002Fidentity\u002Fauth","3.modules\u002F1.identity\u002F1.auth\u002Findex",[172,174,178,182,186],{"title":173,"path":169,"stem":170},"Overview",{"title":175,"path":176,"stem":177},"Server API","\u002Fmodules\u002Fidentity\u002Fauth\u002Fserver","3.modules\u002F1.identity\u002F1.auth\u002F2.server",{"title":179,"path":180,"stem":181},"Reference","\u002Fmodules\u002Fidentity\u002Fauth\u002Freference","3.modules\u002F1.identity\u002F1.auth\u002F3.reference",{"title":183,"path":184,"stem":185},"Client mode","\u002Fmodules\u002Fidentity\u002Fauth\u002Fclient-mode","3.modules\u002F1.identity\u002F1.auth\u002F4.client-mode",{"title":187,"path":188,"stem":189},"OAuth providers","\u002Fmodules\u002Fidentity\u002Fauth\u002Foauth-providers","3.modules\u002F1.identity\u002F1.auth\u002F5.oauth-providers",{"title":191,"path":192,"stem":193},"Users","\u002Fmodules\u002Fidentity\u002Fusers","3.modules\u002F1.identity\u002F2.users",{"title":195,"path":196,"stem":197},"Account","\u002Fmodules\u002Fidentity\u002Faccount","3.modules\u002F1.identity\u002F3.account",{"title":199,"path":200,"stem":201,"children":202},"Authorization","\u002Fmodules\u002Fidentity\u002Fauthorization","3.modules\u002F1.identity\u002F4.authorization\u002Findex",[203,204,208,212,216],{"title":173,"path":200,"stem":201},{"title":205,"path":206,"stem":207},"Roles and requirements","\u002Fmodules\u002Fidentity\u002Fauthorization\u002Froles-and-requirements","3.modules\u002F1.identity\u002F4.authorization\u002F2.roles-and-requirements",{"title":209,"path":210,"stem":211},"Policies","\u002Fmodules\u002Fidentity\u002Fauthorization\u002Fpolicies","3.modules\u002F1.identity\u002F4.authorization\u002F3.policies",{"title":213,"path":214,"stem":215},"Client","\u002Fmodules\u002Fidentity\u002Fauthorization\u002Fclient","3.modules\u002F1.identity\u002F4.authorization\u002F4.client",{"title":217,"path":218,"stem":219},"Admin","\u002Fmodules\u002Fidentity\u002Fauthorization\u002Fadmin","3.modules\u002F1.identity\u002F4.authorization\u002F5.admin",{"title":221,"path":222,"stem":223},"Preferences","\u002Fmodules\u002Fidentity\u002Fpreferences","3.modules\u002F1.identity\u002F5.preferences",{"title":225,"path":226,"stem":227,"children":228},"OAuth Server","\u002Fmodules\u002Fidentity\u002Foauth-server","3.modules\u002F1.identity\u002F6.oauth-server\u002Findex",[229,230,233,237],{"title":173,"path":226,"stem":227},{"title":175,"path":231,"stem":232},"\u002Fmodules\u002Fidentity\u002Foauth-server\u002Fserver","3.modules\u002F1.identity\u002F6.oauth-server\u002F2.server",{"title":234,"path":235,"stem":236},"Hooks","\u002Fmodules\u002Fidentity\u002Foauth-server\u002Fhooks","3.modules\u002F1.identity\u002F6.oauth-server\u002F3.hooks",{"title":179,"path":238,"stem":239},"\u002Fmodules\u002Fidentity\u002Foauth-server\u002Froutes-and-clients","3.modules\u002F1.identity\u002F6.oauth-server\u002F4.routes-and-clients",{"title":241,"path":242,"stem":243},"OAuth Resource","\u002Fmodules\u002Fidentity\u002Foauth-resource","3.modules\u002F1.identity\u002F8.oauth-resource",{"title":245,"icon":49,"path":246,"stem":247,"children":248,"page":49},"Commerce","\u002Fmodules\u002Fcommerce","3.modules\u002F2.commerce",[249,253,257],{"title":250,"path":251,"stem":252},"Stripe","\u002Fmodules\u002Fcommerce\u002Fstripe","3.modules\u002F2.commerce\u002F1.stripe",{"title":254,"path":255,"stem":256},"Payments","\u002Fmodules\u002Fcommerce\u002Fpayments","3.modules\u002F2.commerce\u002F2.payments",{"title":258,"path":259,"stem":260,"children":261},"Subscriptions","\u002Fmodules\u002Fcommerce\u002Fsubscriptions","3.modules\u002F2.commerce\u002F3.subscriptions\u002Findex",[262,263,266,270],{"title":173,"path":259,"stem":260},{"title":175,"path":264,"stem":265},"\u002Fmodules\u002Fcommerce\u002Fsubscriptions\u002Fserver","3.modules\u002F2.commerce\u002F3.subscriptions\u002F2.server",{"title":267,"path":268,"stem":269},"App","\u002Fmodules\u002Fcommerce\u002Fsubscriptions\u002Fapp","3.modules\u002F2.commerce\u002F3.subscriptions\u002F3.app",{"title":179,"path":271,"stem":272},"\u002Fmodules\u002Fcommerce\u002Fsubscriptions\u002Freference","3.modules\u002F2.commerce\u002F3.subscriptions\u002F4.reference",{"title":274,"icon":49,"path":275,"stem":276,"children":277,"page":49},"Features","\u002Fmodules\u002Ffeatures","3.modules\u002F3.features",[278,293,312,316],{"title":279,"path":280,"stem":281,"children":282},"Events","\u002Fmodules\u002Ffeatures\u002Fevents","3.modules\u002F3.features\u002F1.events\u002Findex",[283,284,287,290],{"title":173,"path":280,"stem":281},{"title":175,"path":285,"stem":286},"\u002Fmodules\u002Ffeatures\u002Fevents\u002Fserver","3.modules\u002F3.features\u002F1.events\u002F2.server",{"title":267,"path":288,"stem":289},"\u002Fmodules\u002Ffeatures\u002Fevents\u002Fapp","3.modules\u002F3.features\u002F1.events\u002F3.app",{"title":179,"path":291,"stem":292},"\u002Fmodules\u002Ffeatures\u002Fevents\u002Freference","3.modules\u002F3.features\u002F1.events\u002F4.reference",{"title":294,"path":295,"stem":296,"children":297},"Forms","\u002Fmodules\u002Ffeatures\u002Fforms","3.modules\u002F3.features\u002F2.forms\u002Findex",[298,299,303,306,309],{"title":173,"path":295,"stem":296},{"title":300,"path":301,"stem":302},"Definition","\u002Fmodules\u002Ffeatures\u002Fforms\u002Fdefinition","3.modules\u002F3.features\u002F2.forms\u002F2.definition",{"title":175,"path":304,"stem":305},"\u002Fmodules\u002Ffeatures\u002Fforms\u002Fserver","3.modules\u002F3.features\u002F2.forms\u002F3.server",{"title":267,"path":307,"stem":308},"\u002Fmodules\u002Ffeatures\u002Fforms\u002Fapp","3.modules\u002F3.features\u002F2.forms\u002F4.app",{"title":179,"path":310,"stem":311},"\u002Fmodules\u002Ffeatures\u002Fforms\u002Freference","3.modules\u002F3.features\u002F2.forms\u002F5.reference",{"title":313,"path":314,"stem":315},"Cookie Consent","\u002Fmodules\u002Ffeatures\u002Fcookie-consent","3.modules\u002F3.features\u002F3.cookie-consent",{"title":317,"path":318,"stem":319},"MCP","\u002Fmodules\u002Ffeatures\u002Fmcp","3.modules\u002F3.features\u002F4.mcp",{"title":321,"icon":49,"path":322,"stem":323,"children":324,"page":49},"Interface","\u002Fmodules\u002Finterface","3.modules\u002F4.interface",[325,350,353,357,361],{"title":326,"path":327,"stem":328,"children":329},"UI","\u002Fmodules\u002Finterface\u002Fui","3.modules\u002F4.interface\u002F1.ui\u002Findex",[330,331,335,339,343,347],{"title":173,"path":327,"stem":328},{"title":332,"path":333,"stem":334},"Page components","\u002Fmodules\u002Finterface\u002Fui\u002Fpage-components","3.modules\u002F4.interface\u002F1.ui\u002F2.page-components",{"title":336,"path":337,"stem":338},"App shell","\u002Fmodules\u002Finterface\u002Fui\u002Fapp-shell","3.modules\u002F4.interface\u002F1.ui\u002F3.app-shell",{"title":340,"path":341,"stem":342},"Form inputs","\u002Fmodules\u002Finterface\u002Fui\u002Fform-inputs","3.modules\u002F4.interface\u002F1.ui\u002F4.form-inputs",{"title":344,"path":345,"stem":346},"Composables and helpers","\u002Fmodules\u002Finterface\u002Fui\u002Fcomposables","3.modules\u002F4.interface\u002F1.ui\u002F5.composables",{"title":179,"path":348,"stem":349},"\u002Fmodules\u002Finterface\u002Fui\u002Freference","3.modules\u002F4.interface\u002F1.ui\u002F6.reference",{"title":217,"path":351,"stem":352},"\u002Fmodules\u002Finterface\u002Fadmin","3.modules\u002F4.interface\u002F2.admin",{"title":354,"path":355,"stem":356},"Menu","\u002Fmodules\u002Finterface\u002Fmenu","3.modules\u002F4.interface\u002F3.menu",{"title":358,"path":359,"stem":360},"Widget","\u002Fmodules\u002Finterface\u002Fwidget","3.modules\u002F4.interface\u002F4.widget",{"title":362,"path":363,"stem":364,"children":365},"Mobile","\u002Fmodules\u002Finterface\u002Fmobile","3.modules\u002F4.interface\u002F5.mobile\u002Findex",[366,367,371],{"title":173,"path":363,"stem":364},{"title":368,"path":369,"stem":370},"CLI and devices","\u002Fmodules\u002Finterface\u002Fmobile\u002Fcli-and-devices","3.modules\u002F4.interface\u002F5.mobile\u002F2.cli-and-devices",{"title":372,"path":373,"stem":374},"Splash screen","\u002Fmodules\u002Finterface\u002Fmobile\u002Fsplash-screen","3.modules\u002F4.interface\u002F5.mobile\u002F3.splash-screen",{"title":376,"icon":49,"path":377,"stem":378,"children":379,"page":49},"Platform","\u002Fmodules\u002Fplatform","3.modules\u002F5.platform",[380,402,406,423],{"title":381,"path":382,"stem":383,"children":384},"Module Kit","\u002Fmodules\u002Fplatform\u002Fmodule-kit","3.modules\u002F5.platform\u002F1.module-kit\u002Findex",[385,386,390,394,398],{"title":173,"path":382,"stem":383},{"title":387,"path":388,"stem":389},"Server toolkit","\u002Fmodules\u002Fplatform\u002Fmodule-kit\u002Fserver-toolkit","3.modules\u002F5.platform\u002F1.module-kit\u002F2.server-toolkit",{"title":391,"path":392,"stem":393},"Registries and menus","\u002Fmodules\u002Fplatform\u002Fmodule-kit\u002Fregistries-and-menus","3.modules\u002F5.platform\u002F1.module-kit\u002F3.registries-and-menus",{"title":395,"path":396,"stem":397},"Translations","\u002Fmodules\u002Fplatform\u002Fmodule-kit\u002Fi18n","3.modules\u002F5.platform\u002F1.module-kit\u002F4.i18n",{"title":399,"path":400,"stem":401},"Database helpers","\u002Fmodules\u002Fplatform\u002Fmodule-kit\u002Fdatabase","3.modules\u002F5.platform\u002F1.module-kit\u002F5.database",{"title":403,"path":404,"stem":405},"Notify","\u002Fmodules\u002Fplatform\u002Fnotify","3.modules\u002F5.platform\u002F2.notify",{"title":407,"path":408,"stem":409,"children":410},"Email Templates","\u002Fmodules\u002Fplatform\u002Femail-templates","3.modules\u002F5.platform\u002F3.email-templates\u002Findex",[411,412,416,419],{"title":173,"path":408,"stem":409},{"title":413,"path":414,"stem":415},"Email components","\u002Fmodules\u002Fplatform\u002Femail-templates\u002Fcomponents","3.modules\u002F5.platform\u002F3.email-templates\u002F2.components",{"title":175,"path":417,"stem":418},"\u002Fmodules\u002Fplatform\u002Femail-templates\u002Fserver","3.modules\u002F5.platform\u002F3.email-templates\u002F3.server",{"title":420,"path":421,"stem":422},"Module emails","\u002Fmodules\u002Fplatform\u002Femail-templates\u002Fmodule-emails","3.modules\u002F5.platform\u002F3.email-templates\u002F4.module-emails",{"title":424,"path":425,"stem":426,"children":427},"Base Layer","\u002Fmodules\u002Fplatform\u002Fbase-layer","3.modules\u002F5.platform\u002F4.base-layer\u002Findex",[428,429,433,437],{"title":173,"path":425,"stem":426},{"title":430,"path":431,"stem":432},"Content collections","\u002Fmodules\u002Fplatform\u002Fbase-layer\u002Fcontent-collections","3.modules\u002F5.platform\u002F4.base-layer\u002F2.content-collections",{"title":434,"path":435,"stem":436},"Layouts and routing","\u002Fmodules\u002Fplatform\u002Fbase-layer\u002Flayouts-and-routing","3.modules\u002F5.platform\u002F4.base-layer\u002F3.layouts-and-routing",{"title":438,"path":439,"stem":440},"Composables and utils","\u002Fmodules\u002Fplatform\u002Fbase-layer\u002Fcomposables-and-utils","3.modules\u002F5.platform\u002F4.base-layer\u002F4.composables-and-utils",{"title":442,"icon":443,"path":444,"stem":445,"children":446,"page":49},"Examples","i-lucide-code-xml","\u002Fexamples","4.examples",[447,466,476],{"title":448,"icon":49,"path":449,"stem":450,"children":451,"page":49},"Starters","\u002Fexamples\u002Fstarters","4.examples\u002F1.starters",[452,456,461],{"title":453,"path":454,"stem":455,"icon":6},"Workspace starter","\u002Fexamples\u002Fstarters\u002Fworkspace","4.examples\u002F1.starters\u002F1.workspace",{"title":457,"path":458,"stem":459,"icon":460},"Mobile starter","\u002Fexamples\u002Fstarters\u002Fmobile","4.examples\u002F1.starters\u002F2.mobile","i-lucide-smartphone",{"title":462,"path":463,"stem":464,"icon":465},"Standalone mobile starter","\u002Fexamples\u002Fstarters\u002Fmobile-standalone","4.examples\u002F1.starters\u002F3.mobile-standalone","i-lucide-tablet-smartphone",{"title":467,"icon":49,"path":468,"stem":469,"children":470,"page":49},"Apps","\u002Fexamples\u002Fapps","4.examples\u002F2.apps",[471],{"title":472,"path":473,"stem":474,"icon":475},"Frigear website app","\u002Fexamples\u002Fapps\u002Ffrigear-nu-website","4.examples\u002F2.apps\u002F1.frigear-nu-website","i-lucide-layout-dashboard",{"title":477,"icon":49,"path":478,"stem":479,"children":480,"page":49},"Tasks","\u002Fexamples\u002Ftasks","4.examples\u002F3.tasks",[481,485,489,494,499],{"title":482,"path":483,"stem":484,"icon":70},"Protect a route","\u002Fexamples\u002Ftasks\u002Fprotect-a-route","4.examples\u002F3.tasks\u002F1.protect-a-route",{"title":486,"path":487,"stem":488,"icon":475},"Add an admin page","\u002Fexamples\u002Ftasks\u002Fadd-an-admin-page","4.examples\u002F3.tasks\u002F2.add-an-admin-page",{"title":490,"path":491,"stem":492,"icon":493},"Sell event tickets","\u002Fexamples\u002Ftasks\u002Fsell-event-tickets","4.examples\u002F3.tasks\u002F3.sell-event-tickets","i-lucide-ticket",{"title":495,"path":496,"stem":497,"icon":498},"Build a form","\u002Fexamples\u002Ftasks\u002Fbuild-a-form","4.examples\u002F3.tasks\u002F4.build-a-form","i-lucide-clipboard-list",{"title":500,"path":501,"stem":502,"icon":503},"Send an email","\u002Fexamples\u002Ftasks\u002Fsend-an-email","4.examples\u002F3.tasks\u002F5.send-an-email","i-lucide-mail",{"title":505,"icon":506,"path":507,"stem":508,"children":509,"page":49},"Contribute","i-lucide-git-pull-request","\u002Fcontribute","5.contribute",[510,513,518,544,549,552,556,571],{"title":173,"path":511,"stem":512,"icon":506},"\u002Fcontribute\u002Foverview","5.contribute\u002F1.overview",{"title":514,"path":515,"stem":516,"icon":517},"Local development","\u002Fcontribute\u002Flocal-development","5.contribute\u002F2.local-development","i-lucide-terminal",{"title":519,"icon":49,"path":520,"stem":521,"children":522,"page":49},"Writing a module","\u002Fcontribute\u002Fwriting-a-module","5.contribute\u002F3.writing-a-module",[523,527,532,536,541],{"title":524,"path":525,"stem":526,"icon":39},"Scaffold a module","\u002Fcontribute\u002Fwriting-a-module\u002Fscaffold","5.contribute\u002F3.writing-a-module\u002F1.scaffold",{"title":528,"path":529,"stem":530,"icon":531},"Setup checklist","\u002Fcontribute\u002Fwriting-a-module\u002Fsetup-checklist","5.contribute\u002F3.writing-a-module\u002F2.setup-checklist","i-lucide-list-checks",{"title":533,"path":534,"stem":535,"icon":44},"Database tables","\u002Fcontribute\u002Fwriting-a-module\u002Fdatabase-tables","5.contribute\u002F3.writing-a-module\u002F3.database-tables",{"title":537,"path":538,"stem":539,"icon":540},"Testing","\u002Fcontribute\u002Fwriting-a-module\u002Ftesting","5.contribute\u002F3.writing-a-module\u002F4.testing","i-lucide-flask-conical",{"title":67,"path":542,"stem":543,"icon":70},"\u002Fcontribute\u002Fwriting-a-module\u002Faccess-control","5.contribute\u002F3.writing-a-module\u002F5.access-control",{"title":545,"path":546,"stem":547,"icon":548},"Publishing","\u002Fcontribute\u002Fpublishing","5.contribute\u002F4.publishing","i-lucide-package-check",{"title":448,"path":550,"stem":551,"icon":6},"\u002Fcontribute\u002Fstarters","5.contribute\u002F5.starters",{"title":553,"path":554,"stem":555,"icon":52},"Documentation","\u002Fcontribute\u002Fdocumentation","5.contribute\u002F6.documentation",{"title":557,"icon":49,"path":558,"stem":559,"children":560,"page":49},"Tooling","\u002Fcontribute\u002Ftooling","5.contribute\u002F7.tooling",[561,566],{"title":562,"path":563,"stem":564,"icon":565},"CLI","\u002Fcontribute\u002Ftooling\u002Fcli","5.contribute\u002F7.tooling\u002F1.cli","i-lucide-square-terminal",{"title":567,"path":568,"stem":569,"icon":570},"ESLint config","\u002Fcontribute\u002Ftooling\u002Feslint-config","5.contribute\u002F7.tooling\u002F2.eslint-config","i-lucide-spell-check",{"title":572,"icon":49,"path":573,"stem":574,"children":575},"Decisions","\u002Fcontribute\u002Fdecisions","5.contribute\u002F8.decisions\u002Findex",[576,578,583],{"title":572,"path":573,"stem":574,"icon":577},"i-lucide-scale",{"title":579,"path":580,"stem":581,"icon":582},"Session lifetimes per OAuth client","\u002Fcontribute\u002Fdecisions\u002Foauth-token-lifetimes","5.contribute\u002F8.decisions\u002F1.oauth-token-lifetimes","i-lucide-timer",{"title":584,"path":585,"stem":586,"icon":70},"One permission model","\u002Fcontribute\u002Fdecisions\u002Fpermission-model","5.contribute\u002F8.decisions\u002F2.permission-model",{"id":588,"title":141,"body":589,"description":1264,"extension":1265,"links":1266,"meta":1267,"navigation":1268,"path":142,"seo":1269,"stem":143,"__hash__":1270},"docs\u002F2.guide\u002F4.going-further\u002F3.signing-keys.md",{"type":590,"value":591,"toc":1253},"minimark",[592,601,617,622,630,634,641,934,957,964,968,983,1006,1015,1019,1031,1049,1081,1087,1110,1222,1226,1249],[593,594,595,596,600],"p",{},"Every token your ",[597,598,599],"a",{"href":87},"issuer"," hands out is signed, so the apps and services that receive it can\ntrust it. A production issuer has no key until you give it one, and a leaked key lets anyone mint tokens. This page\ngenerates a key, stores it for each environment and rotates it without signing anyone out.",[602,603,605,609,610,612,613,616],"callout",{"icon":604},"i-lucide-users",[606,607,608],"strong",{},"For:"," whoever deploys an app that runs ",[597,611,225],{"href":226},", including\n",[597,614,615],{"href":132},"your own issuer",".",[618,619,621],"h2",{"id":620},"how-signing-works","How signing works",[593,623,624,625,629],{},"OAuth Server signs ID tokens and access tokens with an RSA private key, using RS256 (RSA with SHA-256). It derives the\nmatching public key from the private key. It publishes that public key as a JSON Web Key Set (JWKS) at\n",[626,627,628],"code",{},"\u002F.well-known\u002Fjwks.json",". OAuth applications and services use it to verify tokens.",[618,631,633],{"id":632},"generate-and-store-a-key","Generate and store a key",[635,636,637,638,616],"caution",{},"Keep the private key out of git, and delete the local file once the secret is stored. Anyone with this key can mint\ntokens for every application. Use a ",[606,639,640],{},"different key per environment",[642,643,644,649,659,741,744,772,787,791,798,819,823,830],"steps",{},[645,646,648],"h3",{"id":647},"generate-a-key-pair","Generate a key pair",[593,650,651,652,658],{},"Generate one with ",[597,653,657],{"href":654,"rel":655},"https:\u002F\u002Fwww.openssl.org\u002F",[656],"nofollow","OpenSSL",":",[660,661,666],"pre",{"className":662,"code":663,"language":664,"meta":665,"style":665},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","# 2048-bit RSA private key, PKCS#8 (-----BEGIN PRIVATE KEY-----)\nopenssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out oauth-private.pem\n\n# Optional: the matching public key, e.g. to compare with the JWKS\nopenssl pkey -in oauth-private.pem -pubout -out oauth-public.pem\n","bash","",[626,667,668,677,706,713,719],{"__ignoreMap":665},[669,670,673],"span",{"class":671,"line":672},"line",1,[669,674,676],{"class":675},"sHwdD","# 2048-bit RSA private key, PKCS#8 (-----BEGIN PRIVATE KEY-----)\n",[669,678,680,684,688,691,694,697,700,703],{"class":671,"line":679},2,[669,681,683],{"class":682},"sBMFI","openssl",[669,685,687],{"class":686},"sfazB"," genpkey",[669,689,690],{"class":686}," -algorithm",[669,692,693],{"class":686}," RSA",[669,695,696],{"class":686}," -pkeyopt",[669,698,699],{"class":686}," rsa_keygen_bits:2048",[669,701,702],{"class":686}," -out",[669,704,705],{"class":686}," oauth-private.pem\n",[669,707,709],{"class":671,"line":708},3,[669,710,712],{"emptyLinePlaceholder":711},true,"\n",[669,714,716],{"class":671,"line":715},4,[669,717,718],{"class":675},"# Optional: the matching public key, e.g. to compare with the JWKS\n",[669,720,722,724,727,730,733,736,738],{"class":671,"line":721},5,[669,723,683],{"class":682},[669,725,726],{"class":686}," pkey",[669,728,729],{"class":686}," -in",[669,731,732],{"class":686}," oauth-private.pem",[669,734,735],{"class":686}," -pubout",[669,737,702],{"class":686},[669,739,740],{"class":686}," oauth-public.pem\n",[593,742,743],{},"Without OpenSSL, Node.js generates the same thing:",[660,745,747],{"className":662,"code":746,"language":664,"meta":665,"style":665},"node -e \"const {generateKeyPairSync}=require('node:crypto');const k=generateKeyPairSync('rsa',{modulusLength:2048,privateKeyEncoding:{type:'pkcs8',format:'pem'},publicKeyEncoding:{type:'spki',format:'pem'}});console.log(k.privateKey)\" > oauth-private.pem\n",[626,748,749],{"__ignoreMap":665},[669,750,751,754,757,761,764,767,770],{"class":671,"line":672},[669,752,753],{"class":682},"node",[669,755,756],{"class":686}," -e",[669,758,760],{"class":759},"sMK4o"," \"",[669,762,763],{"class":686},"const {generateKeyPairSync}=require('node:crypto');const k=generateKeyPairSync('rsa',{modulusLength:2048,privateKeyEncoding:{type:'pkcs8',format:'pem'},publicKeyEncoding:{type:'spki',format:'pem'}});console.log(k.privateKey)",[669,765,766],{"class":759},"\"",[669,768,769],{"class":759}," >",[669,771,705],{"class":686},[773,774,775,776,779,780,783,784,616],"warning",{},"The key must be in PKCS#8 format (",[626,777,778],{},"BEGIN PRIVATE KEY","). PKCS#1 (",[626,781,782],{},"BEGIN RSA PRIVATE KEY",") is rejected. Convert it with\n",[626,785,786],{},"openssl pkcs8 -topk8 -nocrypt -in old.pem -out oauth-private.pem",[645,788,790],{"id":789},"turn-it-into-one-line","Turn it into one line",[593,792,793,794,797],{},"Environment variables are single-line, so newlines are written as a literal ",[626,795,796],{},"\\n",". Wrapping quotes are stripped. This\nprints the value, ready to paste:",[660,799,801],{"className":662,"code":800,"language":664,"meta":665,"style":665},"awk 'NF {printf \"%s\\\\n\", $0}' oauth-private.pem\n",[626,802,803],{"__ignoreMap":665},[669,804,805,808,811,814,817],{"class":671,"line":672},[669,806,807],{"class":682},"awk",[669,809,810],{"class":759}," '",[669,812,813],{"class":686},"NF {printf \"%s\\\\n\", $0}",[669,815,816],{"class":759},"'",[669,818,705],{"class":686},[645,820,822],{"id":821},"store-it-in-each-environment","Store it in each environment",[593,824,825,826,829],{},"Set ",[626,827,828],{},"NUXT_OAUTH_SERVER_PRIVATE_KEY"," wherever the app runs:",[831,832,833,855,899],"code-group",{},[660,834,837],{"className":662,"code":835,"filename":836,"language":664,"meta":665,"style":665},"NUXT_OAUTH_SERVER_PRIVATE_KEY=\"-----BEGIN PRIVATE KEY-----\\nMIIEvQIBADANBgkq...\\n-----END PRIVATE KEY-----\"\n",".env (local)",[626,838,839],{"__ignoreMap":665},[669,840,841,844,847,849,852],{"class":671,"line":672},[669,842,828],{"class":843},"sTEyZ",[669,845,846],{"class":759},"=",[669,848,766],{"class":759},[669,850,851],{"class":686},"-----BEGIN PRIVATE KEY-----\\nMIIEvQIBADANBgkq...\\n-----END PRIVATE KEY-----",[669,853,854],{"class":759},"\"\n",[660,856,859],{"className":662,"code":857,"filename":858,"language":664,"meta":665,"style":665},"# Stored as an encrypted secret on the worker, not in wrangler.json\nawk 'NF {printf \"%s\\\\n\", $0}' oauth-private.pem | pnpm dlx wrangler secret put NUXT_OAUTH_SERVER_PRIVATE_KEY\n","Cloudflare Workers",[626,860,861,866],{"__ignoreMap":665},[669,862,863],{"class":671,"line":672},[669,864,865],{"class":675},"# Stored as an encrypted secret on the worker, not in wrangler.json\n",[669,867,868,870,872,874,876,878,881,884,887,890,893,896],{"class":671,"line":679},[669,869,807],{"class":682},[669,871,810],{"class":759},[669,873,813],{"class":686},[669,875,816],{"class":759},[669,877,732],{"class":686},[669,879,880],{"class":759}," |",[669,882,883],{"class":682}," pnpm",[669,885,886],{"class":686}," dlx",[669,888,889],{"class":686}," wrangler",[669,891,892],{"class":686}," secret",[669,894,895],{"class":686}," put",[669,897,898],{"class":686}," NUXT_OAUTH_SERVER_PRIVATE_KEY\n",[660,900,903],{"className":662,"code":901,"filename":902,"language":664,"meta":665,"style":665},"# Repository secret, passed to the deploy step as NUXT_OAUTH_SERVER_PRIVATE_KEY\nawk 'NF {printf \"%s\\\\n\", $0}' oauth-private.pem | gh secret set NUXT_OAUTH_SERVER_PRIVATE_KEY\n","GitHub Actions",[626,904,905,910],{"__ignoreMap":665},[669,906,907],{"class":671,"line":672},[669,908,909],{"class":675},"# Repository secret, passed to the deploy step as NUXT_OAUTH_SERVER_PRIVATE_KEY\n",[669,911,912,914,916,918,920,922,924,927,929,932],{"class":671,"line":679},[669,913,807],{"class":682},[669,915,810],{"class":759},[669,917,813],{"class":686},[669,919,816],{"class":759},[669,921,732],{"class":686},[669,923,880],{"class":759},[669,925,926],{"class":682}," gh",[669,928,892],{"class":686},[669,930,931],{"class":686}," set",[669,933,898],{"class":686},[602,935,938,941,942,944,945,948,949,952,953,956],{"icon":936,"color":937},"i-lucide-check","success",[606,939,940],{},"What you should see:"," ",[626,943,628],{}," returns one key, with ",[626,946,947],{},"kty: \"RSA\"",", your ",[626,950,951],{},"kid"," and no ",[626,954,955],{},"d"," field.",[593,958,959,960,963],{},"A missing or malformed key answers ",[626,961,962],{},"500"," \"The OAuth server signing keys are not configured.\"",[618,965,967],{"id":966},"development-key","Development key",[593,969,970,971,974,975,978,979,982],{},"You need no key under ",[626,972,973],{},"nuxt dev",". When no private key is configured, the module generates one into\n",[626,976,977],{},".data\u002Foauth-server\u002Fdev-key.pem"," (mode ",[626,980,981],{},"0600",") the first time. It reuses that key on every restart, with a warning in\nthe console.",[984,985,986,997,1000,1003],"ul",{},[987,988,989,990,992,993,996],"li",{},"\"No private key\" means neither ",[626,991,828],{}," nor ",[626,994,995],{},"runtimeConfig.oauthServer.privateKey"," is set.",[987,998,999],{},"Sign-in works out of the box, and tokens survive restarts.",[987,1001,1002],{},"Delete the file to get a new key.",[987,1004,1005],{},"If the file cannot be written, the module warns, and the dev server behaves as it does without a key.",[773,1007,1008,1011,1012,616],{},[626,1009,1010],{},"nuxt build"," never generates a key. A production server without one keeps answering ",[626,1013,1014],{},"500 not_configured",[618,1016,1018],{"id":1017},"rotate-a-key","Rotate a key",[593,1020,1021,1022,1025,1026,1030],{},"Rotation has an ",[606,1023,1024],{},"overlap period",". New tokens are signed with the new key. The old key's ",[1027,1028,1029],"em",{},"public"," half stays in the\nJWKS, and keeps verifying tokens already issued. Nobody is signed out. Refresh tokens are opaque, so rotation does not\naffect them.",[635,1032,1033,1034,1037,1038,1041,1042,1044,1045,1048],{},"If a private key ",[606,1035,1036],{},"leaked",", do not follow these steps. Keeping it in ",[626,1039,1040],{},"previousPublicKeys"," would keep its tokens valid\nfor the overlap period. Instead, replace the key, leave ",[626,1043,1040],{}," empty, and use ",[606,1046,1047],{},"Sign everyone out"," on\neach application in the admin area.",[1050,1051,1052,1055,1064,1069,1074],"ol",{},[987,1053,1054],{},"Generate a new key pair, as above.",[987,1056,1057,1058,1060,1061,616],{},"Move the old public key into ",[626,1059,1040],{},", keyed by its old ",[626,1062,1063],{},"keyId",[987,1065,1066,1067,616],{},"Switch to the new private key and a new ",[626,1068,1063],{},[987,1070,1071,1072,616],{},"Deploy. The JWKS lists both keys. Apps that cache it pick up the new key when they meet an unknown ",[626,1073,951],{},[987,1075,1076,1077,1080],{},"Wait for the longest token lifetime: ",[626,1078,1079],{},"accessTokenTtl",", plus the time apps cache your JWKS. Then remove the old\nentry.",[593,1082,1083,1084,1086],{},"This prints the public key you are retiring, as a JSON object keyed by its ",[626,1085,951],{},", ready for an environment variable:",[660,1088,1090],{"className":662,"code":1089,"language":664,"meta":665,"style":665},"# The public key of the key you are retiring, as a JSON object keyed by its kid (single line, ready for an env var)\nnode -e \"console.log(JSON.stringify({ 'key-1': require('fs').readFileSync('oauth-public-old.pem','utf8') }))\"\n",[626,1091,1092,1097],{"__ignoreMap":665},[669,1093,1094],{"class":671,"line":672},[669,1095,1096],{"class":675},"# The public key of the key you are retiring, as a JSON object keyed by its kid (single line, ready for an env var)\n",[669,1098,1099,1101,1103,1105,1108],{"class":671,"line":679},[669,1100,753],{"class":682},[669,1102,756],{"class":686},[669,1104,760],{"class":759},[669,1106,1107],{"class":686},"console.log(JSON.stringify({ 'key-1': require('fs').readFileSync('oauth-public-old.pem','utf8') }))",[669,1109,854],{"class":759},[831,1111,1112,1183],{},[660,1113,1118],{"className":1114,"code":1115,"filename":1116,"language":1117,"meta":665,"style":665},"language-ts shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","export default defineNuxtConfig({\n  oauthServer: {\n    keyId: 'key-2', \u002F\u002F the new key\n  },\n})\n","nuxt.config.ts","ts",[626,1119,1120,1139,1150,1170,1175],{"__ignoreMap":665},[669,1121,1122,1126,1129,1133,1136],{"class":671,"line":672},[669,1123,1125],{"class":1124},"s7zQu","export",[669,1127,1128],{"class":1124}," default",[669,1130,1132],{"class":1131},"s2Zo4"," defineNuxtConfig",[669,1134,1135],{"class":843},"(",[669,1137,1138],{"class":759},"{\n",[669,1140,1141,1145,1147],{"class":671,"line":679},[669,1142,1144],{"class":1143},"swJcz","  oauthServer",[669,1146,658],{"class":759},[669,1148,1149],{"class":759}," {\n",[669,1151,1152,1155,1157,1159,1162,1164,1167],{"class":671,"line":708},[669,1153,1154],{"class":1143},"    keyId",[669,1156,658],{"class":759},[669,1158,810],{"class":759},[669,1160,1161],{"class":686},"key-2",[669,1163,816],{"class":759},[669,1165,1166],{"class":759},",",[669,1168,1169],{"class":675}," \u002F\u002F the new key\n",[669,1171,1172],{"class":671,"line":715},[669,1173,1174],{"class":759},"  },\n",[669,1176,1177,1180],{"class":671,"line":721},[669,1178,1179],{"class":759},"}",[669,1181,1182],{"class":843},")\n",[660,1184,1187],{"className":662,"code":1185,"filename":1186,"language":664,"meta":665,"style":665},"NUXT_OAUTH_SERVER_PRIVATE_KEY=\"-----BEGIN PRIVATE KEY-----\\n…new key…\\n-----END PRIVATE KEY-----\"\n# The retired key: public half only, nothing is signed with it any more\nNUXT_OAUTH_SERVER_PREVIOUS_PUBLIC_KEYS='{\"key-1\":\"-----BEGIN PUBLIC KEY-----\\n…old key…\\n-----END PUBLIC KEY-----\\n\"}'\n",".env",[626,1188,1189,1202,1207],{"__ignoreMap":665},[669,1190,1191,1193,1195,1197,1200],{"class":671,"line":672},[669,1192,828],{"class":843},[669,1194,846],{"class":759},[669,1196,766],{"class":759},[669,1198,1199],{"class":686},"-----BEGIN PRIVATE KEY-----\\n…new key…\\n-----END PRIVATE KEY-----",[669,1201,854],{"class":759},[669,1203,1204],{"class":671,"line":679},[669,1205,1206],{"class":675},"# The retired key: public half only, nothing is signed with it any more\n",[669,1208,1209,1212,1214,1216,1219],{"class":671,"line":708},[669,1210,1211],{"class":843},"NUXT_OAUTH_SERVER_PREVIOUS_PUBLIC_KEYS",[669,1213,846],{"class":759},[669,1215,816],{"class":759},[669,1217,1218],{"class":686},"{\"key-1\":\"-----BEGIN PUBLIC KEY-----\\n…old key…\\n-----END PUBLIC KEY-----\\n\"}",[669,1220,1221],{"class":759},"'\n",[618,1223,1225],{"id":1224},"next-steps","Next steps",[984,1227,1228,1233,1238],{},[987,1229,1230,1232],{},[597,1231,136],{"href":137}," – register the apps that verify these tokens.",[987,1234,1235,1237],{},[597,1236,46],{"href":47}," – set the key as a secret on your hosting platform.",[987,1239,1240,1242,1243,1245,1246,1248],{},[597,1241,225],{"href":226}," – look up the ",[626,1244,1063],{}," and ",[626,1247,1040],{}," options.",[1250,1251,1252],"style",{},"html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .s7zQu, html code.shiki .s7zQu{--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic}html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}html pre.shiki code .swJcz, html code.shiki .swJcz{--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178}",{"title":665,"searchDepth":679,"depth":679,"links":1254},[1255,1256,1261,1262,1263],{"id":620,"depth":679,"text":621},{"id":632,"depth":679,"text":633,"children":1257},[1258,1259,1260],{"id":647,"depth":708,"text":648},{"id":789,"depth":708,"text":790},{"id":821,"depth":708,"text":822},{"id":966,"depth":679,"text":967},{"id":1017,"depth":679,"text":1018},{"id":1224,"depth":679,"text":1225},"Give OAuth Server the private key it signs tokens with, per environment, and rotate it without signing anyone out.","md",null,{},{"icon":144},{"title":141,"description":1264},"y860LVb2iTwOO46fuTDrTxM5yLowmgUv7RLxHiicCZk",[1272,1274],{"title":136,"path":137,"stem":138,"description":1273,"icon":139,"children":-1},"Register an app at an issuer that runs OAuth Server, as a confidential application in the admin area or a public one in the admin area or nuxt.config.",{"title":146,"path":147,"stem":148,"description":1275,"icon":149,"children":-1},"Set up the Stripe dashboard, webhook endpoint, keys and KV once, so Stripe, Payments and Subscriptions all work, in production and locally.",1794503151629]