Authentication

Passkeys are the primary human credential. Account creation registers a WebAuthn credential; browser login verifies a WebAuthn assertion.

The OhRats-managed service may allow public signup. Public signup is gated by Cloudflare Turnstile before RC issues a WebAuthn registration ceremony. Self-hosted instances remain invite/setup-only unless their operator explicitly enables and configures public signup.

Sensitive operations can require a fresh passkey assertion even when a browser session is already active. Examples include authority changes and durable execution authorization.

Browser login creates an HTTP-only RC session cookie. The default lifetime is 30 days.

Available lifetimes are 1 hour, 1 day, 7 days, 30 days, 90 days, 180 days, and 1 year. Browser sessions do not offer an until-revoked cookie lifetime.

The first browser control action creates a local Ed25519 control identity. RC asks a passkey to authorize that public key for the requested control lifetime.

The browser retains the signing key locally. RC stores the public key and passkey-backed authorization needed for the Node to verify later control operations.

rc login generates a local Ed25519 control key, starts a short browser authorization flow, and waits for passkey approval.

The default CLI authorization lifetime is until revoked. Finite values are 1h, 1d, 7d, 30d, 90d, 180d, and 1y.

rc logout revokes the hosted CLI session and deletes the local account session.

API keys are Ed25519 proof-of-possession credentials. The browser generates the key pair and sends RC only the public key. The private key is shown once in the rcsk_ credential.

Every API request signs the key ID, timestamp, nonce, method, path/query, and SHA-256 body digest. RC accepts a 60-second timestamp window and rejects reused nonces.

API keys default to until revoked and may be scoped to read, execute, manage-devices, and manage-workspaces.

MCP uses OAuth with Protected Resource Metadata, PKCE S256, and an exact resource value for the RC MCP endpoint.

Access tokens are short-lived and refresh tokens rotate. The durable MCP grant separately records selected machines, scopes, and authorization lifetime.

Execution-capable approval requires an Owner and a fresh passkey ceremony. A browser control identity signs the exact grant, and its hash is synchronized into RC Lock before the grant is usable on a Node.

Protocol challenges, OAuth authorization codes, WebAuthn ceremonies, and step-up tokens remain short-lived independently of the durable authorization lifetime.

• Browser logout invalidates the browser session.
• rc logout revokes the CLI session.
• Revoking an API key removes it from hosted state and synchronizes affected RC Locks.
• Revoking an MCP connection invalidates its OAuth tokens and removes its execution grant from affected RC Locks.
• Removing a passkey prevents future assertions with that credential. RC prevents removing the last viable primary credential through the normal UI/API path.