Identity

Arc identity support composes domain-specific details from an authenticated request principal and presents them to frontend clients. It does not modify or validate the provider’s token. Authentication, pipeline authorization, and identity presentation are separate concerns.

Overview

Provider identities often lack application-specific display information. Arc lets you compose it in the backend and publish a consistent frontend payload. A details provider can make an application-entry decision; it runs for every identity request. Protect commands and queries independently with pipeline authorization.

Key capabilities:

• Enrich provider identity with domain-specific details
• Supply an application-entry decision on every identity request
• Return a single consolidated identity payload
• Present details to frontend clients through /.cratis/me

Caution

The identity is presentation data. Do not use its flags, roles, or details in place of backend authorization. See provider flow and trust. Arc no longer uses the .cratis-identity cookie; see migrating from the identity cookie.

Topics

Topic	Description
Provider Flow	Endpoint mapping, provider implementation, request flow, and frontend integration.
Identity Contracts	IdentityProviderContext and IdentityDetails structures used by providers.
IdentityProvider Service	Advanced runtime identity retrieval and mutation with IIdentityProvider.
Development and Topologies	Development endpoints plus single-service and multi-service composition patterns.
Migrating from the Identity Cookie	What changed when Arc stopped trusting the .cratis-identity cookie, and what to change.