mirror of
https://github.com/agentrhq/authsome.git
synced 2026-09-19 01:34:19 +08:00
beubax
26 lines
1.8 KiB
Plaintext
26 lines
1.8 KiB
Plaintext
---
|
|
title: "The local daemon"
|
|
sidebarTitle: "The local daemon"
|
|
description: "Why Authsome runs a persistent background daemon to broker credentials."
|
|
icon: "server"
|
|
keywords: ["authsome daemon", "AUTHSOME_BASE_URL", "AUTHSOME_BASE_URL", "authsome dashboard"]
|
|
---
|
|
|
|
Authsome can operate against a persistent local daemon, usually running on `127.0.0.1:7998`. Hosted Authsome is the default client target; set `AUTHSOME_BASE_URL=http://127.0.0.1:7998` when you want the CLI and injection proxy to use a local daemon. You only need `AUTHSOME_CALLBACK_BASE_URL` for self-hosted servers or local daemons running on a non-default browser-facing host or port.
|
|
|
|
## Concept and motivation
|
|
|
|
Authentication flows hold state. They involve asynchronous steps like browser redirects and callbacks. If Authsome were a short-lived CLI tool, these flows would break:
|
|
|
|
- **OAuth callbacks:** OAuth needs a listening port for the provider's redirect. A CLI exits before you finish logging in.
|
|
- **Session state:** Multi-step operations and token refresh logic need a place to live.
|
|
- **Secure injection:** The proxy needs an isolated component to fetch fresh tokens without exposing the Vault decryption keys to the proxy process itself.
|
|
|
|
The daemon solves this. It runs a persistent, in-memory coordinator that manages browser bridges, handles OAuth callbacks, serves the dashboard, and orchestrates the Vault and Auth layers.
|
|
|
|
## Trust boundary and authorization
|
|
|
|
To ensure that only authorized clients can request credentials from the daemon, Authsome uses **Proof-of-Possession (PoP) JWTs**.
|
|
|
|
Every request made by the CLI or the proxy to the daemon carries a short-lived JWT signed by the agent's cryptographic Identity (Ed25519 key). The daemon verifies the signature and ensures the Identity is bound to a valid Principal before serving the credential or performing any Vault operation.
|