Self-hosted identity profiles: minimal, bring your own IdP, full
You run Cratis applications on your own infrastructure. You need to decide how users sign in, how invitations reach people, and how tools such as MCP clients authenticate.
There are three profiles. All of them put AuthProxy at the edge, and we recommend configuring signed forwarded identity between AuthProxy and Arc in every one of them. The profiles differ in where tokens come from.
Choose a profile
Section titled “Choose a profile”| Profile | Who it fits | What signs people in | What API and MCP clients use |
|---|---|---|---|
| Minimal | Small teams that do not want to run an authorization server. | AuthProxy, against the provider you configure. | Personal access tokens (Planned), validated inside your install with no call to Cratis cloud. |
| Bring your own IdP | Organizations with an existing identity provider, for example Microsoft Entra ID or Okta. | AuthProxy, against your OpenID Connect provider. | Access tokens from your authorization server, accepted on bearer routes. Personal access tokens alongside them are Planned. |
| Full | Operators who want the Cratis consent screen, cratis CLI sign-in, and remote MCP connectors. |
A Cratis Identity realm that you operate yourself (Planned). | Tokens issued by that realm (Planned). |
Components and contracts per profile
Section titled “Components and contracts per profile”Minimal
Section titled “Minimal”| Component | Role in this profile | Status | Learn more |
|---|---|---|---|
| Your application (Arc and Chronicle) | Runs your commands, queries, and event store. | Available | Arc, Chronicle |
| AuthProxy | Signs users in and routes requests. | Available | Authentication |
| Ante | Optional. Runs invitations and registration if you onboard that way. | Available | Ante on GitHub |
| Personal access tokens | Authenticate MCP and API clients. | Planned | |
| Signed forwarded identity | AuthProxy vouches for identity to Arc. | Available, opt-in | Signing |
Bring your own IdP
Section titled “Bring your own IdP”| Component | Role in this profile | Status | Learn more |
|---|---|---|---|
| Your application (Arc and Chronicle) | Runs your commands, queries, and event store. | Available | Arc, Chronicle |
| AuthProxy with your OpenID Connect provider | Browser sign-in. | Available | Authentication |
| AuthProxy bearer routes | API and MCP paths accept tokens from your authorization server. | Available since AuthProxy 2.30.0 | Bearer routes |
| Personal access tokens | Used alongside your tokens. | Planned | |
| Ante | Optional. Runs invitations and registration if you onboard that way. | Available | Ante on GitHub |
| Signed forwarded identity | AuthProxy vouches for identity to Arc. | Available, opt-in | Signing |
Signing in through your provider in a browser does not prove that the same provider works as an authorization server for MCP clients. Test both.
| Component | Role in this profile | Status | Learn more |
|---|---|---|---|
| Your application (Arc and Chronicle) | Runs your commands, queries, and event store. | Available | Arc, Chronicle |
| AuthProxy | Edge, routing, and sign-in. | Available | AuthProxy |
| Ante | Invitations and registration. | Available | Ante on GitHub |
| Cratis Identity realm that you operate | Consent screen, CLI sign-in, and remote MCP connectors. | Planned | |
| Signed forwarded identity | AuthProxy vouches for identity to Arc. | Available, opt-in | Signing |
Sign forwarded identity in every profile
Section titled “Sign forwarded identity in every profile”AuthProxy authenticates the caller and forwards identity to Arc. AuthProxy can sign that forwarded identity and Arc can verify it. Signing is opt-in: when both sides are configured, Arc accepts forwarded identity only when its signature verifies.
Signing needs AuthProxy 2.44.0 or later and Arc 22.168.0 or later. See forwarded identity signing in AuthProxy and signed forwarded identity in Arc. If you run AuthProxy under Aspire, the Aspire guide covers the pairing.
Invitations without mail
Section titled “Invitations without mail”Ante signs invitation links and runs the lobby. It never sends email. Your application receives the link and decides how to deliver it: through your own mail service, or by showing it to an administrator to copy and send.
AuthProxy validates the link and runs sign-in. See the lobby documentation and the Ante repository. Both are available today.
If you run no onboarding service, your application adds members through its own authenticated administration path. If you run no MCP clients, the browser application works unchanged.
Disconnected does not mean one process
Section titled “Disconnected does not mean one process”A disconnected install makes no call to Cratis cloud. It still runs AuthProxy, Ante if you use it, and, in the full profile, an identity host as separate containers on your own network.
Packing those components into one process, or embedding identity in your application’s host, would be a different, optional compact deployment. That is not what disconnected means, and it is not offered as a profile.
In the minimal profile, personal access token validation is planned to happen locally, with no outbound call (Planned). Browser sign-in still talks to the OIDC provider you configure.
What to decide up front
Section titled “What to decide up front”| Decision | Ask this | Start here |
|---|---|---|
| Identity provider | Where do browser users sign in? | AuthProxy authentication |
| Invitation delivery | How do invitation links reach people? | AuthProxy lobby |
| API and MCP paths | Which paths serve API and MCP clients, and which tokens do they accept? | Bearer routes |
| Signing keys | Which signing configuration does each backend use? | Signed forwarded identity |