PairCodeAccess controlApply for a credential
An operator account is the identity every room checks. Create one, and the server issues the access token, the rotating refresh token, and the socket ticket that get you through the door.
What the door enforcesIn this repository
- Password storage
- Argon2idlib/auth/password.ts
- Access tokens
- EdDSA (Ed25519) JWTlib/auth/jwt.ts
- Refresh tokens
- Rotated, reuse detected and revokedlib/auth/refresh.ts
- Form submission
- CSRF token, double submitlib/auth/csrf.ts
- Socket handshake
- Single-use ticket, redeemed by deletelib/security/ws-ticket.ts
- Room authorization
- Server-side RBAC on every eventserver/ws-server.mjs
No third-party auth service sits behind these rows.
Credential application
??
Bearer
Unissued
no identity presented