mix openfeed.gen.key (OpenFeed v0.1.0)

Copy Markdown View Source

Generate the RSA keypair OpenFeed needs.

One key does two jobs: it authenticates your client (private_key_jwt) and it signs DPoP proofs. OpenFeed holds the public half as a registered JWKS.

This is a deliberate, explicit step. OpenFeed.KeyStore will not generate a key behind your back, because a store that does so gives every node in a cluster a different key and OpenFeed rejects proofs signed by keys it has never seen.

Write it to a file

mix openfeed.gen.key --path priv/openfeed.jwk

Suitable for local development. Not multi-node safe unless the path is shared storage.

Print it, for a secret manager

mix openfeed.gen.key --print
mix openfeed.gen.key --print --base64

Store the output wherever your secrets live and expose it to the application as an environment variable, then use OpenFeed.KeyStore.Env. This is the right choice for a release.

Options

  • --path PATH — write the private JWK here, mode 0600.
  • --print — write the private JWK to stdout instead.
  • --base64 — with --print, base64-encode it so it survives being passed around as a single line.
  • --force — overwrite an existing file. Without it, an existing file is an error, because silently replacing a key breaks every grant you hold.

Next step

Register the public half with OpenFeed:

mix openfeed.jwks --path priv/openfeed.jwk