[{"data":1,"prerenderedAt":990},["ShallowReactive",2],{"navigation":3,"/getting-started/setup-identity-provider":145,"/getting-started/setup-identity-provider-surround":985},[4,28,49,88,101,127],{"title":5,"path":6,"stem":7,"children":8,"icon":27},"Getting Started","/getting-started","1.getting-started/1.index",[9,11,15,19,23],{"title":10,"path":6,"stem":7},"Introduction",{"title":12,"path":13,"stem":14},"Working with Agents","/getting-started/working-with-agents","1.getting-started/2.working-with-agents",{"title":16,"path":17,"stem":18},"Setup a Service Provider","/getting-started/setup-service-provider","1.getting-started/3.setup-service-provider",{"title":20,"path":21,"stem":22},"Setup an Identity Provider","/getting-started/setup-identity-provider","1.getting-started/4.setup-identity-provider",{"title":24,"path":25,"stem":26},"Developers","/getting-started/developers","1.getting-started/5.developers",false,{"title":29,"icon":27,"path":30,"stem":31,"children":32,"page":27},"Guides","/guides","2.guides",[33,37,41,45],{"title":34,"path":35,"stem":36},"How It Works","/guides/how-it-works","2.guides/1.how-it-works",{"title":38,"path":39,"stem":40},"Capabilities Guide","/guides/capabilities-guide","2.guides/2.capabilities-guide",{"title":42,"path":43,"stem":44},"End-to-End Tutorial","/guides/end-to-end-tutorial","2.guides/3.end-to-end-tutorial",{"title":46,"path":47,"stem":48},"Delegation Guide","/guides/delegation-guide","2.guides/4.delegation-guide",{"title":50,"path":51,"stem":52,"children":53,"icon":27},"Ecosystem","/ecosystem","3.ecosystem/1.index",[54,56,60,64,68,72,76,80,84],{"title":55,"path":51,"stem":52},"Overview",{"title":57,"path":58,"stem":59},"grapes CLI","/ecosystem/grapes","3.ecosystem/2.grapes",{"title":61,"path":62,"stem":63},"shapes CLI","/ecosystem/shapes","3.ecosystem/3.shapes",{"title":65,"path":66,"stem":67},"escapes","/ecosystem/escapes","3.ecosystem/4.escapes",{"title":69,"path":70,"stem":71},"OpenApe Proxy","/ecosystem/proxy","3.ecosystem/5.proxy",{"title":73,"path":74,"stem":75},"OpenApe Browser","/ecosystem/browser","3.ecosystem/6.browser",{"title":77,"path":78,"stem":79},"OpenApe Auth","/ecosystem/auth","3.ecosystem/7.auth",{"title":81,"path":82,"stem":83},"OpenApe Grants","/ecosystem/grants","3.ecosystem/8.grants",{"title":85,"path":86,"stem":87},"nuxt-auth-sp","/ecosystem/nuxt-auth-sp","3.ecosystem/9.nuxt-auth-sp",{"title":89,"icon":27,"path":90,"stem":91,"children":92,"page":27},"Security","/security","4.security",[93,97],{"title":94,"path":95,"stem":96},"Compliance","/security/compliance","4.security/1.compliance",{"title":98,"path":99,"stem":100},"Threat Model","/security/threat-model","4.security/2.threat-model",{"title":102,"path":103,"stem":104,"children":105,"icon":27},"Reference","/reference","5.reference/1.index",[106,107,111,115,119,123],{"title":102,"path":103,"stem":104},{"title":108,"path":109,"stem":110},"IdP Configuration","/reference/idp-configuration","5.reference/2.idp-configuration",{"title":112,"path":113,"stem":114},"SP Configuration","/reference/sp-configuration","5.reference/3.sp-configuration",{"title":116,"path":117,"stem":118},"API Endpoints","/reference/api-endpoints","5.reference/4.api-endpoints",{"title":120,"path":121,"stem":122},"escapes Config","/reference/escapes-config","5.reference/5.escapes-config",{"title":124,"path":125,"stem":126},"Proxy Config","/reference/proxy-config","5.reference/6.proxy-config",{"title":128,"path":129,"stem":130,"children":131,"icon":27},"Operations","/operations","6.operations/1.index",[132,133,137,141],{"title":128,"path":129,"stem":130},{"title":134,"path":135,"stem":136},"Deployment","/operations/deployment","6.operations/2.deployment",{"title":138,"path":139,"stem":140},"Troubleshooting","/operations/troubleshooting","6.operations/3.troubleshooting",{"title":142,"path":143,"stem":144},"Monitoring","/operations/monitoring","6.operations/4.monitoring",{"id":146,"title":20,"body":147,"description":978,"extension":979,"links":980,"meta":981,"navigation":982,"path":21,"seo":983,"stem":22,"__hash__":984},"docs/1.getting-started/4.setup-identity-provider.md",{"type":148,"value":149,"toc":966},"minimark",[150,155,160,164,197,201,208,248,255,404,424,428,431,445,487,494,532,541,611,639,647,655,659,666,671,815,819,867,871,890,894,913,916,931,935,962],[151,152,154],"h1",{"id":153},"quick-start","Quick Start",[156,157,159],"h2",{"id":158},"add-a-dns-record","Add a DNS Record",[161,162,163],"p",{},"Point your domain to your IdP by adding a TXT record:",[165,166,171],"pre",{"className":167,"code":168,"language":169,"meta":170,"style":170},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","_ddisa.example.com TXT \"v=ddisa1; idp=https://id.example.com; mode=strict\"\n","bash","",[172,173,174],"code",{"__ignoreMap":170},[175,176,179,183,187,191,194],"span",{"class":177,"line":178},"line",1,[175,180,182],{"class":181},"sBMFI","_ddisa.example.com",[175,184,186],{"class":185},"sfazB"," TXT",[175,188,190],{"class":189},"sMK4o"," \"",[175,192,193],{"class":185},"v=ddisa1; idp=https://id.example.com; mode=strict",[175,195,196],{"class":189},"\"\n",[156,198,200],{"id":199},"deploy-the-idp","Deploy the IdP",[161,202,203,204,207],{},"The fastest way is a Nuxt app with the ",[172,205,206],{},"@openape/nuxt-auth-idp"," module:",[165,209,211],{"className":167,"code":210,"language":169,"meta":170,"style":170},"npx nuxi init my-idp\ncd my-idp\npnpm add @openape/nuxt-auth-idp\n",[172,212,213,227,236],{"__ignoreMap":170},[175,214,215,218,221,224],{"class":177,"line":178},[175,216,217],{"class":181},"npx",[175,219,220],{"class":185}," nuxi",[175,222,223],{"class":185}," init",[175,225,226],{"class":185}," my-idp\n",[175,228,230,234],{"class":177,"line":229},2,[175,231,233],{"class":232},"s2Zo4","cd",[175,235,226],{"class":185},[175,237,239,242,245],{"class":177,"line":238},3,[175,240,241],{"class":181},"pnpm",[175,243,244],{"class":185}," add",[175,246,247],{"class":185}," @openape/nuxt-auth-idp\n",[161,249,250,251,254],{},"Configure ",[172,252,253],{},"nuxt.config.ts",":",[165,256,260],{"className":257,"code":258,"language":259,"meta":170,"style":170},"language-ts shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","export default defineNuxtConfig({\n  modules: ['@openape/nuxt-auth-idp'],\n  openapeIdp: {\n    rpName: 'My Identity Provider',\n    rpID: 'id.example.com',\n    rpOrigin: 'https://id.example.com',\n    storageDriver: 's3', // or '' for local filesystem\n  },\n})\n","ts",[172,261,262,281,305,315,333,350,367,389,395],{"__ignoreMap":170},[175,263,264,268,271,274,278],{"class":177,"line":178},[175,265,267],{"class":266},"s7zQu","export",[175,269,270],{"class":266}," default",[175,272,273],{"class":232}," defineNuxtConfig",[175,275,277],{"class":276},"sTEyZ","(",[175,279,280],{"class":189},"{\n",[175,282,283,287,289,292,295,297,299,302],{"class":177,"line":229},[175,284,286],{"class":285},"swJcz","  modules",[175,288,254],{"class":189},[175,290,291],{"class":276}," [",[175,293,294],{"class":189},"'",[175,296,206],{"class":185},[175,298,294],{"class":189},[175,300,301],{"class":276},"]",[175,303,304],{"class":189},",\n",[175,306,307,310,312],{"class":177,"line":238},[175,308,309],{"class":285},"  openapeIdp",[175,311,254],{"class":189},[175,313,314],{"class":189}," {\n",[175,316,318,321,323,326,329,331],{"class":177,"line":317},4,[175,319,320],{"class":285},"    rpName",[175,322,254],{"class":189},[175,324,325],{"class":189}," '",[175,327,328],{"class":185},"My Identity Provider",[175,330,294],{"class":189},[175,332,304],{"class":189},[175,334,336,339,341,343,346,348],{"class":177,"line":335},5,[175,337,338],{"class":285},"    rpID",[175,340,254],{"class":189},[175,342,325],{"class":189},[175,344,345],{"class":185},"id.example.com",[175,347,294],{"class":189},[175,349,304],{"class":189},[175,351,353,356,358,360,363,365],{"class":177,"line":352},6,[175,354,355],{"class":285},"    rpOrigin",[175,357,254],{"class":189},[175,359,325],{"class":189},[175,361,362],{"class":185},"https://id.example.com",[175,364,294],{"class":189},[175,366,304],{"class":189},[175,368,370,373,375,377,380,382,385],{"class":177,"line":369},7,[175,371,372],{"class":285},"    storageDriver",[175,374,254],{"class":189},[175,376,325],{"class":189},[175,378,379],{"class":185},"s3",[175,381,294],{"class":189},[175,383,384],{"class":189},",",[175,386,388],{"class":387},"sHwdD"," // or '' for local filesystem\n",[175,390,392],{"class":177,"line":391},8,[175,393,394],{"class":189},"  },\n",[175,396,398,401],{"class":177,"line":397},9,[175,399,400],{"class":189},"}",[175,402,403],{"class":276},")\n",[161,405,406,407,410,411,410,414,410,417,410,420,423],{},"All routes are auto-registered: ",[172,408,409],{},"/login",", ",[172,412,413],{},"/register",[172,415,416],{},"/authorize",[172,418,419],{},"/token",[172,421,422],{},"/.well-known/jwks.json",", and the full admin API.",[156,425,427],{"id":426},"deploy-the-sp","Deploy the SP",[161,429,430],{},"For a service that accepts OpenApe login:",[165,432,434],{"className":167,"code":433,"language":169,"meta":170,"style":170},"pnpm add @openape/nuxt-auth-sp\n",[172,435,436],{"__ignoreMap":170},[175,437,438,440,442],{"class":177,"line":178},[175,439,241],{"class":181},[175,441,244],{"class":185},[175,443,444],{"class":185}," @openape/nuxt-auth-sp\n",[165,446,448],{"className":257,"code":447,"language":259,"meta":170,"style":170},"export default defineNuxtConfig({\n  modules: ['@openape/nuxt-auth-sp'],\n})\n",[172,449,450,462,481],{"__ignoreMap":170},[175,451,452,454,456,458,460],{"class":177,"line":178},[175,453,267],{"class":266},[175,455,270],{"class":266},[175,457,273],{"class":232},[175,459,277],{"class":276},[175,461,280],{"class":189},[175,463,464,466,468,470,472,475,477,479],{"class":177,"line":229},[175,465,286],{"class":285},[175,467,254],{"class":189},[175,469,291],{"class":276},[175,471,294],{"class":189},[175,473,474],{"class":185},"@openape/nuxt-auth-sp",[175,476,294],{"class":189},[175,478,301],{"class":276},[175,480,304],{"class":189},[175,482,483,485],{"class":177,"line":238},[175,484,400],{"class":189},[175,486,403],{"class":276},[161,488,489,490,493],{},"That's it for development — the module auto-generates secrets and derives ",[172,491,492],{},"clientId"," from your dev server. Add a login page:",[165,495,499],{"className":496,"code":497,"language":498,"meta":170,"style":170},"language-vue shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","\u003Ctemplate>\n  \u003COpenApeAuth />\n\u003C/template>\n","vue",[172,500,501,512,523],{"__ignoreMap":170},[175,502,503,506,509],{"class":177,"line":178},[175,504,505],{"class":189},"\u003C",[175,507,508],{"class":285},"template",[175,510,511],{"class":189},">\n",[175,513,514,517,520],{"class":177,"line":229},[175,515,516],{"class":189},"  \u003C",[175,518,519],{"class":285},"OpenApeAuth",[175,521,522],{"class":189}," />\n",[175,524,525,528,530],{"class":177,"line":238},[175,526,527],{"class":189},"\u003C/",[175,529,508],{"class":285},[175,531,511],{"class":189},[161,533,534,535,537,538,254],{},"For production, set ",[172,536,492],{}," and ",[172,539,540],{},"sessionSecret",[165,542,544],{"className":257,"code":543,"language":259,"meta":170,"style":170},"export default defineNuxtConfig({\n  modules: ['@openape/nuxt-auth-sp'],\n  openapeSp: {\n    clientId: 'myapp.example.com',\n  },\n})\n",[172,545,546,558,576,585,601,605],{"__ignoreMap":170},[175,547,548,550,552,554,556],{"class":177,"line":178},[175,549,267],{"class":266},[175,551,270],{"class":266},[175,553,273],{"class":232},[175,555,277],{"class":276},[175,557,280],{"class":189},[175,559,560,562,564,566,568,570,572,574],{"class":177,"line":229},[175,561,286],{"class":285},[175,563,254],{"class":189},[175,565,291],{"class":276},[175,567,294],{"class":189},[175,569,474],{"class":185},[175,571,294],{"class":189},[175,573,301],{"class":276},[175,575,304],{"class":189},[175,577,578,581,583],{"class":177,"line":238},[175,579,580],{"class":285},"  openapeSp",[175,582,254],{"class":189},[175,584,314],{"class":189},[175,586,587,590,592,594,597,599],{"class":177,"line":317},[175,588,589],{"class":285},"    clientId",[175,591,254],{"class":189},[175,593,325],{"class":189},[175,595,596],{"class":185},"myapp.example.com",[175,598,294],{"class":189},[175,600,304],{"class":189},[175,602,603],{"class":177,"line":335},[175,604,394],{"class":189},[175,606,607,609],{"class":177,"line":352},[175,608,400],{"class":189},[175,610,403],{"class":276},[165,612,614],{"className":167,"code":613,"language":169,"meta":170,"style":170},"NUXT_OPENAPE_SP_SESSION_SECRET=$(openssl rand -hex 32)\n",[172,615,616],{"__ignoreMap":170},[175,617,618,621,624,627,630,633,637],{"class":177,"line":178},[175,619,620],{"class":276},"NUXT_OPENAPE_SP_SESSION_SECRET",[175,622,623],{"class":189},"=$(",[175,625,626],{"class":181},"openssl",[175,628,629],{"class":185}," rand",[175,631,632],{"class":185}," -hex",[175,634,636],{"class":635},"sbssI"," 32",[175,638,403],{"class":189},[161,640,641,642,646],{},"The SP is ",[643,644,645],"strong",{},"fully stateless"," — OAuth flow state lives in signed cookies. Zero server storage needed.",[161,648,649,650,654],{},"See the ",[651,652,653],"a",{"href":86},"nuxt-auth-sp docs"," for full configuration reference.",[156,656,658],{"id":657},"environment-variables","Environment Variables",[161,660,661,662,665],{},"All configuration can be set via ",[172,663,664],{},"NUXT_OPENAPE_*"," environment variables:",[667,668,670],"h3",{"id":669},"idp","IdP",[672,673,674,690],"table",{},[675,676,677],"thead",{},[678,679,680,684,687],"tr",{},[681,682,683],"th",{},"Variable",[681,685,686],{},"Description",[681,688,689],{},"Default",[691,692,693,709,724,739,755,767,779,791,803],"tbody",{},[678,694,695,701,704],{},[696,697,698],"td",{},[172,699,700],{},"NUXT_OPENAPE_RP_ID",[696,702,703],{},"Relying Party ID (domain)",[696,705,706],{},[172,707,708],{},"localhost",[678,710,711,716,719],{},[696,712,713],{},[172,714,715],{},"NUXT_OPENAPE_RP_ORIGIN",[696,717,718],{},"Relying Party origin (URL)",[696,720,721],{},[172,722,723],{},"http://localhost:3000",[678,725,726,731,734],{},[696,727,728],{},[172,729,730],{},"NUXT_OPENAPE_RP_NAME",[696,732,733],{},"Display name",[696,735,736],{},[172,737,738],{},"OpenApe Identity",[678,740,741,746,752],{},[696,742,743],{},[172,744,745],{},"NUXT_OPENAPE_STORAGE_DRIVER",[696,747,748,749,751],{},"Storage driver (",[172,750,379],{}," or empty for FS)",[696,753,754],{},"``",[678,756,757,762,765],{},[696,758,759],{},[172,760,761],{},"NUXT_OPENAPE_ADMIN_EMAILS",[696,763,764],{},"Comma-separated admin emails",[696,766],{},[678,768,769,774,777],{},[696,770,771],{},[172,772,773],{},"NUXT_OPENAPE_MANAGEMENT_TOKEN",[696,775,776],{},"Bearer token for admin API",[696,778],{},[678,780,781,786,789],{},[696,782,783],{},[172,784,785],{},"NUXT_OPENAPE_SESSION_SECRET",[696,787,788],{},"Session encryption secret (32+ chars)",[696,790],{},[678,792,793,798,801],{},[696,794,795],{},[172,796,797],{},"NUXT_OPENAPE_ISSUER",[696,799,800],{},"JWT issuer URL",[696,802],{},[678,804,805,810,813],{},[696,806,807],{},[172,808,809],{},"NUXT_OPENAPE_S3_*",[696,811,812],{},"S3 credentials (ACCESS_KEY, SECRET_KEY, BUCKET, ENDPOINT, REGION)",[696,814],{},[667,816,818],{"id":817},"sp","SP",[672,820,821,831],{},[675,822,823],{},[678,824,825,827,829],{},[681,826,683],{},[681,828,686],{},[681,830,689],{},[691,832,833,845,857],{},[678,834,835,840,843],{},[696,836,837],{},[172,838,839],{},"NUXT_OPENAPE_CLIENT_ID",[696,841,842],{},"Service Provider ID",[696,844],{},[678,846,847,852,855],{},[696,848,849],{},[172,850,851],{},"NUXT_OPENAPE_URL",[696,853,854],{},"IdP URL for discovery",[696,856],{},[678,858,859,863,865],{},[696,860,861],{},[172,862,620],{},[696,864,788],{},[696,866],{},[156,868,870],{"id":869},"install-the-cli","Install the CLI",[165,872,874],{"className":167,"code":873,"language":169,"meta":170,"style":170},"npm i -g @openape/grapes\n",[172,875,876],{"__ignoreMap":170},[175,877,878,881,884,887],{"class":177,"line":178},[175,879,880],{"class":181},"npm",[175,882,883],{"class":185}," i",[175,885,886],{"class":185}," -g",[175,888,889],{"class":185}," @openape/grapes\n",[156,891,893],{"id":892},"create-your-first-user","Create Your First User",[165,895,897],{"className":167,"code":896,"language":169,"meta":170,"style":170},"grapes login --idp https://id.example.com\n",[172,898,899],{"__ignoreMap":170},[175,900,901,904,907,910],{"class":177,"line":178},[175,902,903],{"class":181},"grapes",[175,905,906],{"class":185}," login",[175,908,909],{"class":185}," --idp",[175,911,912],{"class":185}," https://id.example.com\n",[161,914,915],{},"This opens a browser where you register with a Passkey. Once registered, you're logged in.",[917,918,920],"callout",{"type":919},"info",[161,921,922,923,926,927,930],{},"If this is a fresh IdP with no users yet, create a registration URL first via the admin API. See the ",[651,924,925],{"href":117},"API Reference"," for ",[172,928,929],{},"POST /api/admin/registration-urls",".",[156,932,934],{"id":933},"whats-next","What's Next?",[936,937,938,944,950,956],"ul",{},[939,940,941,943],"li",{},[651,942,42],{"href":43}," — Full walkthrough with IdP, SP, and Agent",[939,945,946,949],{},[651,947,948],{"href":25},"Agent Integration"," — Enroll agents and use grants",[939,951,952,955],{},[651,953,954],{"href":109},"IdP Configuration Reference"," — All configuration options",[939,957,958,961],{},[651,959,960],{"href":135},"Deployment Guide"," — Production deployment with Vercel or Docker",[963,964,965],"style",{},"html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}html pre.shiki code .s7zQu, html code.shiki .s7zQu{--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .swJcz, html code.shiki .swJcz{--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178}html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}html pre.shiki code .sbssI, html code.shiki .sbssI{--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C}",{"title":170,"searchDepth":238,"depth":229,"links":967},[968,969,970,971,975,976,977],{"id":158,"depth":229,"text":159},{"id":199,"depth":229,"text":200},{"id":426,"depth":229,"text":427},{"id":657,"depth":229,"text":658,"children":972},[973,974],{"id":669,"depth":238,"text":670},{"id":817,"depth":238,"text":818},{"id":869,"depth":229,"text":870},{"id":892,"depth":229,"text":893},{"id":933,"depth":229,"text":934},"Deploy your own OpenApe IdP with DNS, storage, and Passkey authentication.","md",null,{},true,{"title":20,"description":978},"Gm9pfAinVuwdi5vbzpb8cUVo984hDPdUFMnQEzEpiIQ",[986,988],{"title":16,"path":17,"stem":18,"description":987,"children":-1},"Add OpenApe authentication to your app in 3 steps.",{"title":24,"path":25,"stem":26,"description":989,"children":-1},"Raw API reference for enrolling agents, requesting grants, and using AuthZ-JWTs.",1774221116104]