Identity & Access

One env var and five endpoints separate a scaffolded workspace from a working OAuth sign-in — and the boundaries fail loud with typed errors instead of degrading to a silent anonymous session.

Identity & Access covers the Principal model, authentication backends, sessions, roles, scopes, and claims. Use this pillar when you are adding sign-in, selecting a backend, or reasoning about how identity flows through services and pages.

Auth is where an agent-assembled backend most easily looks done without being done — the mis-wired flow compiles, demos, and ships. NetScript's answer is to keep the security conventions in the contract itself: NETSCRIPT_AUTH_BACKEND selects exactly one active backend, every backend normalizes to the same Principal, unsupported operations fail loud with typed errors, and the redacted audit surface refuses to run without a salt. The full story — including the concrete failure modes the contract closes off — is on the Authentication page.

Capability Authentication

The auth plugin story: one active backend, five endpoints, fail-loud typed boundaries, and the salt-gated audit surface.

Overview & Concepts Auth model

Principal, session, backend, and authorization vocabulary.

Quickstart Workspace auth

Add authentication in the Workspace tutorial.

How-To Add authentication

Wire authentication into a generated workspace.

How-To better-auth plugins

Mount better-auth plugins through a typed passthrough; bearer and jwt run as-is, table-backed and interactive plugins carry caveats.

How-To Session lifecycles

Mount public handlers, redirect, handle callbacks, check return URLs, and forward refresh headers across adapters.