[{"data":1,"prerenderedAt":921},["ShallowReactive",2],{"navigation":3,"\u002Fgetting-started\u002Finstallation":89,"\u002Fgetting-started\u002Finstallation-surround":916},[4,40,63,76],{"title":5,"path":6,"stem":7,"children":8,"icon":39},"Getting Started","\u002Fgetting-started","1.getting-started\u002F1.index",[9,11,15,19,23,27,31,35],{"title":10,"path":6,"stem":7},"Introduction",{"title":12,"path":13,"stem":14},"Quick Start: Service Provider","\u002Fgetting-started\u002Fquickstart-sp","1.getting-started\u002F2.quickstart-sp",{"title":16,"path":17,"stem":18},"Quick Start: Identity Provider","\u002Fgetting-started\u002Fquickstart-idp","1.getting-started\u002F3.quickstart-idp",{"title":20,"path":21,"stem":22},"Quick Start: Agent","\u002Fgetting-started\u002Fquickstart-agent","1.getting-started\u002F4.quickstart-agent",{"title":24,"path":25,"stem":26},"Quick Start","\u002Fgetting-started\u002Finstallation","1.getting-started\u002F5.installation",{"title":28,"path":29,"stem":30},"How It Works","\u002Fgetting-started\u002Fhow-it-works","1.getting-started\u002F6.how-it-works",{"title":32,"path":33,"stem":34},"For Service Providers","\u002Fgetting-started\u002Ffor-service-providers","1.getting-started\u002F7.for-service-providers",{"title":36,"path":37,"stem":38},"CLI (apes & ape-shell)","\u002Fgetting-started\u002Fcli","1.getting-started\u002F8.cli",false,{"title":41,"path":42,"stem":43,"children":44,"icon":39},"Ecosystem","\u002Fecosystem","2.ecosystem\u002F1.index",[45,47,51,55,59],{"title":46,"path":42,"stem":43},"Overview",{"title":48,"path":49,"stem":50},"OpenApe Auth","\u002Fecosystem\u002Fauth","2.ecosystem\u002F2.auth",{"title":52,"path":53,"stem":54},"OpenApe Grants","\u002Fecosystem\u002Fgrants","2.ecosystem\u002F3.grants",{"title":56,"path":57,"stem":58},"nuxt-auth-sp","\u002Fecosystem\u002Fnuxt-auth-sp","2.ecosystem\u002F4.nuxt-auth-sp",{"title":60,"path":61,"stem":62},"escapes","\u002Fecosystem\u002Fescapes","2.ecosystem\u002F5.escapes",{"title":64,"icon":39,"path":65,"stem":66,"children":67,"page":39},"Security","\u002Fsecurity","3.security",[68,72],{"title":69,"path":70,"stem":71},"Compliance","\u002Fsecurity\u002Fcompliance","3.security\u002F1.compliance",{"title":73,"path":74,"stem":75},"Threat Model","\u002Fsecurity\u002Fthreat-model","3.security\u002F2.threat-model",{"title":77,"icon":39,"path":78,"stem":79,"children":80,"page":39},"Guides","\u002Fguides","4.guides",[81,85],{"title":82,"path":83,"stem":84},"Capabilities & Grants","\u002Fguides\u002Fcapabilities","4.guides\u002F1.capabilities",{"title":86,"path":87,"stem":88},"Delegation","\u002Fguides\u002Fdelegation","4.guides\u002F2.delegation",{"id":90,"title":24,"body":91,"description":909,"extension":910,"links":911,"meta":912,"navigation":913,"path":25,"seo":914,"stem":26,"__hash__":915},"docs\u002F1.getting-started\u002F5.installation.md",{"type":92,"value":93,"toc":899},"minimark",[94,98,103,107,140,144,151,194,201,359,379,383,386,400,442,449,487,496,566,594,602,610,614,621,626,770,774,822,826,829,892,895],[95,96,24],"h1",{"id":97},"quick-start",[99,100,102],"h2",{"id":101},"add-a-dns-record","Add a DNS Record",[104,105,106],"p",{},"Point your domain to your IdP by adding a TXT record:",[108,109,114],"pre",{"className":110,"code":111,"language":112,"meta":113,"style":113},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","_ddisa.example.com TXT \"v=ddisa1; idp=https:\u002F\u002Fid.example.com; mode=strict\"\n","bash","",[115,116,117],"code",{"__ignoreMap":113},[118,119,122,126,130,134,137],"span",{"class":120,"line":121},"line",1,[118,123,125],{"class":124},"sBMFI","_ddisa.example.com",[118,127,129],{"class":128},"sfazB"," TXT",[118,131,133],{"class":132},"sMK4o"," \"",[118,135,136],{"class":128},"v=ddisa1; idp=https:\u002F\u002Fid.example.com; mode=strict",[118,138,139],{"class":132},"\"\n",[99,141,143],{"id":142},"deploy-the-idp","Deploy the IdP",[104,145,146,147,150],{},"The fastest way is a Nuxt app with the ",[115,148,149],{},"@openape\u002Fnuxt-auth-idp"," module:",[108,152,154],{"className":110,"code":153,"language":112,"meta":113,"style":113},"npx nuxi init my-idp\ncd my-idp\npnpm add @openape\u002Fnuxt-auth-idp @openape\u002Fnuxt-grants\n",[115,155,156,170,179],{"__ignoreMap":113},[118,157,158,161,164,167],{"class":120,"line":121},[118,159,160],{"class":124},"npx",[118,162,163],{"class":128}," nuxi",[118,165,166],{"class":128}," init",[118,168,169],{"class":128}," my-idp\n",[118,171,173,177],{"class":120,"line":172},2,[118,174,176],{"class":175},"s2Zo4","cd",[118,178,169],{"class":128},[118,180,182,185,188,191],{"class":120,"line":181},3,[118,183,184],{"class":124},"pnpm",[118,186,187],{"class":128}," add",[118,189,190],{"class":128}," @openape\u002Fnuxt-auth-idp",[118,192,193],{"class":128}," @openape\u002Fnuxt-grants\n",[104,195,196,197,200],{},"Configure ",[115,198,199],{},"nuxt.config.ts",":",[108,202,206],{"className":203,"code":204,"language":205,"meta":113,"style":113},"language-ts shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","export default defineNuxtConfig({\n  modules: ['@openape\u002Fnuxt-auth-idp', '@openape\u002Fnuxt-grants'],\n  openapeIdp: {\n    rpName: 'My Identity Provider',\n    rpID: 'id.example.com',\n    rpOrigin: 'https:\u002F\u002Fid.example.com',\n    storageDriver: 's3', \u002F\u002F or '' for local filesystem\n  },\n})\n","ts",[115,207,208,227,262,272,289,306,323,344,350],{"__ignoreMap":113},[118,209,210,214,217,220,224],{"class":120,"line":121},[118,211,213],{"class":212},"s7zQu","export",[118,215,216],{"class":212}," default",[118,218,219],{"class":175}," defineNuxtConfig",[118,221,223],{"class":222},"sTEyZ","(",[118,225,226],{"class":132},"{\n",[118,228,229,233,235,238,241,243,245,248,251,254,256,259],{"class":120,"line":172},[118,230,232],{"class":231},"swJcz","  modules",[118,234,200],{"class":132},[118,236,237],{"class":222}," [",[118,239,240],{"class":132},"'",[118,242,149],{"class":128},[118,244,240],{"class":132},[118,246,247],{"class":132},",",[118,249,250],{"class":132}," '",[118,252,253],{"class":128},"@openape\u002Fnuxt-grants",[118,255,240],{"class":132},[118,257,258],{"class":222},"]",[118,260,261],{"class":132},",\n",[118,263,264,267,269],{"class":120,"line":181},[118,265,266],{"class":231},"  openapeIdp",[118,268,200],{"class":132},[118,270,271],{"class":132}," {\n",[118,273,275,278,280,282,285,287],{"class":120,"line":274},4,[118,276,277],{"class":231},"    rpName",[118,279,200],{"class":132},[118,281,250],{"class":132},[118,283,284],{"class":128},"My Identity Provider",[118,286,240],{"class":132},[118,288,261],{"class":132},[118,290,292,295,297,299,302,304],{"class":120,"line":291},5,[118,293,294],{"class":231},"    rpID",[118,296,200],{"class":132},[118,298,250],{"class":132},[118,300,301],{"class":128},"id.example.com",[118,303,240],{"class":132},[118,305,261],{"class":132},[118,307,309,312,314,316,319,321],{"class":120,"line":308},6,[118,310,311],{"class":231},"    rpOrigin",[118,313,200],{"class":132},[118,315,250],{"class":132},[118,317,318],{"class":128},"https:\u002F\u002Fid.example.com",[118,320,240],{"class":132},[118,322,261],{"class":132},[118,324,326,329,331,333,336,338,340],{"class":120,"line":325},7,[118,327,328],{"class":231},"    storageDriver",[118,330,200],{"class":132},[118,332,250],{"class":132},[118,334,335],{"class":128},"s3",[118,337,240],{"class":132},[118,339,247],{"class":132},[118,341,343],{"class":342},"sHwdD"," \u002F\u002F or '' for local filesystem\n",[118,345,347],{"class":120,"line":346},8,[118,348,349],{"class":132},"  },\n",[118,351,353,356],{"class":120,"line":352},9,[118,354,355],{"class":132},"}",[118,357,358],{"class":222},")\n",[104,360,361,362,365,366,365,369,365,372,365,375,378],{},"All routes are auto-registered: ",[115,363,364],{},"\u002Flogin",", ",[115,367,368],{},"\u002Fregister",[115,370,371],{},"\u002Fauthorize",[115,373,374],{},"\u002Ftoken",[115,376,377],{},"\u002F.well-known\u002Fjwks.json",", and the full admin API.",[99,380,382],{"id":381},"deploy-the-sp","Deploy the SP",[104,384,385],{},"For a service that accepts OpenApe login:",[108,387,389],{"className":110,"code":388,"language":112,"meta":113,"style":113},"pnpm add @openape\u002Fnuxt-auth-sp\n",[115,390,391],{"__ignoreMap":113},[118,392,393,395,397],{"class":120,"line":121},[118,394,184],{"class":124},[118,396,187],{"class":128},[118,398,399],{"class":128}," @openape\u002Fnuxt-auth-sp\n",[108,401,403],{"className":203,"code":402,"language":205,"meta":113,"style":113},"export default defineNuxtConfig({\n  modules: ['@openape\u002Fnuxt-auth-sp'],\n})\n",[115,404,405,417,436],{"__ignoreMap":113},[118,406,407,409,411,413,415],{"class":120,"line":121},[118,408,213],{"class":212},[118,410,216],{"class":212},[118,412,219],{"class":175},[118,414,223],{"class":222},[118,416,226],{"class":132},[118,418,419,421,423,425,427,430,432,434],{"class":120,"line":172},[118,420,232],{"class":231},[118,422,200],{"class":132},[118,424,237],{"class":222},[118,426,240],{"class":132},[118,428,429],{"class":128},"@openape\u002Fnuxt-auth-sp",[118,431,240],{"class":132},[118,433,258],{"class":222},[118,435,261],{"class":132},[118,437,438,440],{"class":120,"line":181},[118,439,355],{"class":132},[118,441,358],{"class":222},[104,443,444,445,448],{},"That's it for development — the module auto-generates secrets and derives ",[115,446,447],{},"clientId"," from your dev server. Add a login page:",[108,450,454],{"className":451,"code":452,"language":453,"meta":113,"style":113},"language-vue shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","\u003Ctemplate>\n  \u003COpenApeAuth \u002F>\n\u003C\u002Ftemplate>\n","vue",[115,455,456,467,478],{"__ignoreMap":113},[118,457,458,461,464],{"class":120,"line":121},[118,459,460],{"class":132},"\u003C",[118,462,463],{"class":231},"template",[118,465,466],{"class":132},">\n",[118,468,469,472,475],{"class":120,"line":172},[118,470,471],{"class":132},"  \u003C",[118,473,474],{"class":231},"OpenApeAuth",[118,476,477],{"class":132}," \u002F>\n",[118,479,480,483,485],{"class":120,"line":181},[118,481,482],{"class":132},"\u003C\u002F",[118,484,463],{"class":231},[118,486,466],{"class":132},[104,488,489,490,492,493,200],{},"For production, set ",[115,491,447],{}," and ",[115,494,495],{},"sessionSecret",[108,497,499],{"className":203,"code":498,"language":205,"meta":113,"style":113},"export default defineNuxtConfig({\n  modules: ['@openape\u002Fnuxt-auth-sp'],\n  openapeSp: {\n    clientId: 'myapp.example.com',\n  },\n})\n",[115,500,501,513,531,540,556,560],{"__ignoreMap":113},[118,502,503,505,507,509,511],{"class":120,"line":121},[118,504,213],{"class":212},[118,506,216],{"class":212},[118,508,219],{"class":175},[118,510,223],{"class":222},[118,512,226],{"class":132},[118,514,515,517,519,521,523,525,527,529],{"class":120,"line":172},[118,516,232],{"class":231},[118,518,200],{"class":132},[118,520,237],{"class":222},[118,522,240],{"class":132},[118,524,429],{"class":128},[118,526,240],{"class":132},[118,528,258],{"class":222},[118,530,261],{"class":132},[118,532,533,536,538],{"class":120,"line":181},[118,534,535],{"class":231},"  openapeSp",[118,537,200],{"class":132},[118,539,271],{"class":132},[118,541,542,545,547,549,552,554],{"class":120,"line":274},[118,543,544],{"class":231},"    clientId",[118,546,200],{"class":132},[118,548,250],{"class":132},[118,550,551],{"class":128},"myapp.example.com",[118,553,240],{"class":132},[118,555,261],{"class":132},[118,557,558],{"class":120,"line":291},[118,559,349],{"class":132},[118,561,562,564],{"class":120,"line":308},[118,563,355],{"class":132},[118,565,358],{"class":222},[108,567,569],{"className":110,"code":568,"language":112,"meta":113,"style":113},"NUXT_OPENAPE_SP_SESSION_SECRET=$(openssl rand -hex 32)\n",[115,570,571],{"__ignoreMap":113},[118,572,573,576,579,582,585,588,592],{"class":120,"line":121},[118,574,575],{"class":222},"NUXT_OPENAPE_SP_SESSION_SECRET",[118,577,578],{"class":132},"=$(",[118,580,581],{"class":124},"openssl",[118,583,584],{"class":128}," rand",[118,586,587],{"class":128}," -hex",[118,589,591],{"class":590},"sbssI"," 32",[118,593,358],{"class":132},[104,595,596,597,601],{},"The SP is ",[598,599,600],"strong",{},"fully stateless"," — OAuth flow state lives in signed cookies. Zero server storage needed.",[104,603,604,605,609],{},"See the ",[606,607,608],"a",{"href":57},"nuxt-auth-sp docs"," for full configuration reference.",[99,611,613],{"id":612},"environment-variables","Environment Variables",[104,615,616,617,620],{},"All configuration can be set via ",[115,618,619],{},"NUXT_OPENAPE_*"," environment variables:",[622,623,625],"h3",{"id":624},"idp","IdP",[627,628,629,645],"table",{},[630,631,632],"thead",{},[633,634,635,639,642],"tr",{},[636,637,638],"th",{},"Variable",[636,640,641],{},"Description",[636,643,644],{},"Default",[646,647,648,664,679,694,710,722,734,746,758],"tbody",{},[633,649,650,656,659],{},[651,652,653],"td",{},[115,654,655],{},"NUXT_OPENAPE_RP_ID",[651,657,658],{},"Relying Party ID (domain)",[651,660,661],{},[115,662,663],{},"localhost",[633,665,666,671,674],{},[651,667,668],{},[115,669,670],{},"NUXT_OPENAPE_RP_ORIGIN",[651,672,673],{},"Relying Party origin (URL)",[651,675,676],{},[115,677,678],{},"http:\u002F\u002Flocalhost:3000",[633,680,681,686,689],{},[651,682,683],{},[115,684,685],{},"NUXT_OPENAPE_RP_NAME",[651,687,688],{},"Display name",[651,690,691],{},[115,692,693],{},"OpenApe Identity",[633,695,696,701,707],{},[651,697,698],{},[115,699,700],{},"NUXT_OPENAPE_STORAGE_DRIVER",[651,702,703,704,706],{},"Storage driver (",[115,705,335],{}," or empty for FS)",[651,708,709],{},"``",[633,711,712,717,720],{},[651,713,714],{},[115,715,716],{},"NUXT_OPENAPE_ADMIN_EMAILS",[651,718,719],{},"Comma-separated admin emails",[651,721],{},[633,723,724,729,732],{},[651,725,726],{},[115,727,728],{},"NUXT_OPENAPE_MANAGEMENT_TOKEN",[651,730,731],{},"Bearer token for admin API",[651,733],{},[633,735,736,741,744],{},[651,737,738],{},[115,739,740],{},"NUXT_OPENAPE_SESSION_SECRET",[651,742,743],{},"Session encryption secret (32+ chars)",[651,745],{},[633,747,748,753,756],{},[651,749,750],{},[115,751,752],{},"NUXT_OPENAPE_ISSUER",[651,754,755],{},"JWT issuer URL",[651,757],{},[633,759,760,765,768],{},[651,761,762],{},[115,763,764],{},"NUXT_OPENAPE_S3_*",[651,766,767],{},"S3 credentials (ACCESS_KEY, SECRET_KEY, BUCKET, ENDPOINT, REGION)",[651,769],{},[622,771,773],{"id":772},"sp","SP",[627,775,776,786],{},[630,777,778],{},[633,779,780,782,784],{},[636,781,638],{},[636,783,641],{},[636,785,644],{},[646,787,788,800,812],{},[633,789,790,795,798],{},[651,791,792],{},[115,793,794],{},"NUXT_OPENAPE_CLIENT_ID",[651,796,797],{},"Service Provider ID",[651,799],{},[633,801,802,807,810],{},[651,803,804],{},[115,805,806],{},"NUXT_OPENAPE_URL",[651,808,809],{},"IdP URL for discovery",[651,811],{},[633,813,814,818,820],{},[651,815,816],{},[115,817,575],{},[651,819,743],{},[651,821],{},[99,823,825],{"id":824},"create-your-first-user","Create Your First User",[104,827,828],{},"Use the management API to create a registration URL:",[108,830,832],{"className":110,"code":831,"language":112,"meta":113,"style":113},"curl -X POST https:\u002F\u002Fid.example.com\u002Fapi\u002Fadmin\u002Fregistration-urls \\\n  -H \"Authorization: Bearer YOUR_MANAGEMENT_TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"email\":\"alice@example.com\",\"name\":\"Alice\"}'\n",[115,833,834,851,866,879],{"__ignoreMap":113},[118,835,836,839,842,845,848],{"class":120,"line":121},[118,837,838],{"class":124},"curl",[118,840,841],{"class":128}," -X",[118,843,844],{"class":128}," POST",[118,846,847],{"class":128}," https:\u002F\u002Fid.example.com\u002Fapi\u002Fadmin\u002Fregistration-urls",[118,849,850],{"class":222}," \\\n",[118,852,853,856,858,861,864],{"class":120,"line":172},[118,854,855],{"class":128},"  -H",[118,857,133],{"class":132},[118,859,860],{"class":128},"Authorization: Bearer YOUR_MANAGEMENT_TOKEN",[118,862,863],{"class":132},"\"",[118,865,850],{"class":222},[118,867,868,870,872,875,877],{"class":120,"line":181},[118,869,855],{"class":128},[118,871,133],{"class":132},[118,873,874],{"class":128},"Content-Type: application\u002Fjson",[118,876,863],{"class":132},[118,878,850],{"class":222},[118,880,881,884,886,889],{"class":120,"line":274},[118,882,883],{"class":128},"  -d",[118,885,250],{"class":132},[118,887,888],{"class":128},"{\"email\":\"alice@example.com\",\"name\":\"Alice\"}",[118,890,891],{"class":132},"'\n",[104,893,894],{},"Open the returned URL in a browser to register a Passkey. Done.",[896,897,898],"style",{},"html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sbssI, html code.shiki .sbssI{--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C}html pre.shiki code .s7zQu, html code.shiki .s7zQu{--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic}html pre.shiki code .swJcz, html code.shiki .swJcz{--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178}html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}",{"title":113,"searchDepth":121,"depth":172,"links":900},[901,902,903,904,908],{"id":101,"depth":172,"text":102},{"id":142,"depth":172,"text":143},{"id":381,"depth":172,"text":382},{"id":612,"depth":172,"text":613,"children":905},[906,907],{"id":624,"depth":181,"text":625},{"id":772,"depth":181,"text":773},{"id":824,"depth":172,"text":825},"Get OpenApe running in minutes.","md",null,{},true,{"title":24,"description":909},"lyLjjSmpXpVW-PeUm0gvCOiF7xF863Oc7oWAMTUoFh0",[917,919],{"title":20,"path":21,"stem":22,"description":918,"children":-1},"Enroll an AI agent with DDISA identity in 3 minutes.",{"title":28,"path":29,"stem":30,"description":920,"children":-1},"The DDISA login flow and grant system explained.",1776885317056]