Machine credentials
Server-to-server auth without a shared secret — private_key_jwt assertions, DPoP-bound tokens, and a published JWKS (RFC-0034).
This deployment
- Private key
- configured · kid GiLPmG079ZFvo5o4UeqzxYVcGco0HVuAhwBLkaWpVXo
- Published keys
- GiLPmG079ZFvo5o4UeqzxYVcGco0HVuAhwBLkaWpVXo
- JWKS
- /.well-known/reopt-client-jwks.json
- Token audience
- https://brandapp.reopt.ai
- adapter client
- gXa03kVoEBtoik2LGTZWFs768gZ8HU9F · brandapp:auth-adapter
- machine client
- 0bF8MCqs1klpJu5HCdc4bPbiM2lW3_uw · brandapp:read brandapp:write
Live probe
Mints one token per client through id.reopt.ai and shows its claims. The token stays on the server.
.env.local
# 1) Generate a key — the private JWK is printed once, as one env line.
npx --package @reopt-ai/brandapp-sdk reopt-keygen
# .env.local (server only — never a browser bundle, log, or commit)
REOPT_CLIENT_PRIVATE_KEY_JWK='{"kty":"OKP","crv":"Ed25519","alg":"EdDSA","kid":"…","x":"…","d":"…"}'
# 2) Rotation: add NEXT, wait for Reopt to pick the new kid up (≤ 5 min),
# then move NEXT into the primary variable and drop NEXT.
# REOPT_CLIENT_PRIVATE_KEY_JWK_NEXT='{…}'