Identity

Arc identity support composes domain-specific details from an authenticated request principal and presents them to frontend clients. It does not modify or validate the provider’s token. Authentication, pipeline authorization, and identity presentation are separate concerns.

Overview

Provider identities often lack application-specific display information. Arc lets you compose it in the backend and publish a consistent frontend payload. A details provider can make an application-entry decision during fresh enrichment, but cached cookie results bypass recomputation. Protect commands and queries independently with pipeline authorization.

Key capabilities:

• Enrich provider identity with domain-specific details
• Supply an application-entry decision during fresh enrichment
• Return a single consolidated identity payload
• Present cached details to frontend clients

Caution

The .cratis-identity cookie is unsigned, client-controlled presentation data. Do not trust its flags, roles, or details for backend authorization. See provider flow and cookie trust and caching.

Topics

Topic	Description
Provider Flow	Endpoint mapping, provider implementation, request flow, and frontend cookie integration.
Identity Contracts	IdentityProviderContext and IdentityDetails structures used by providers.
IdentityProvider Service	Advanced runtime identity retrieval and mutation with IIdentityProvider.
Development and Topologies	Development endpoints plus single-service and multi-service composition patterns.