Generate the RSA keypair OpenFeed needs.
One key does two jobs: it authenticates your client (private_key_jwt) and
it signs DPoP proofs. OpenFeed holds the public half as a registered JWKS.
This is a deliberate, explicit step. OpenFeed.KeyStore will not generate a
key behind your back, because a store that does so gives every node in a
cluster a different key and OpenFeed rejects proofs signed by keys it has
never seen.
Write it to a file
mix openfeed.gen.key --path priv/openfeed.jwkSuitable for local development. Not multi-node safe unless the path is shared storage.
Print it, for a secret manager
mix openfeed.gen.key --print
mix openfeed.gen.key --print --base64Store the output wherever your secrets live and expose it to the application
as an environment variable, then use OpenFeed.KeyStore.Env. This is the
right choice for a release.
Options
--path PATH— write the private JWK here, mode 0600.--print— write the private JWK to stdout instead.--base64— with--print, base64-encode it so it survives being passed around as a single line.--force— overwrite an existing file. Without it, an existing file is an error, because silently replacing a key breaks every grant you hold.
Next step
Register the public half with OpenFeed:
mix openfeed.jwks --path priv/openfeed.jwk