# Identity & Access

**One env var and five endpoints separate a scaffolded workspace from a working OAuth sign-in — and the boundaries fail loud with typed errors instead of degrading to a silent anonymous session.**

Identity & Access covers the Principal model, authentication backends, sessions, roles, scopes, and claims. Use this pillar when you are adding sign-in, selecting a backend, or reasoning about how identity flows through services and pages.

Auth is where an agent-assembled backend most easily *looks* done without *being* done — the mis-wired flow compiles, demos, and ships. NetScript's answer is to keep the security conventions in the contract itself: `NETSCRIPT_AUTH_BACKEND` selects exactly one active backend, every backend normalizes to the same `Principal`, unsupported operations fail loud with typed errors, and the redacted audit surface refuses to run without a salt. The full story — including the concrete failure modes the contract closes off — is on the [Authentication](https://rickylabs.github.io/netscript/identity-access/auth/) page.

[Capability   Authentication  The auth plugin story: one active backend, five endpoints, fail-loud typed boundaries, and the salt-gated audit surface.](https://rickylabs.github.io/netscript/netscript/identity-access/auth/) [Overview & Concepts   Auth model  Principal, session, backend, and authorization vocabulary.](https://rickylabs.github.io/netscript/netscript/explanation/auth-model/) [Quickstart   Workspace auth  Add authentication in the Workspace tutorial.](https://rickylabs.github.io/netscript/netscript/tutorials/workspace/02-auth/) [How-To   Add authentication  Wire authentication into a generated workspace.](https://rickylabs.github.io/netscript/netscript/identity-access/how-to/add-authentication/) [How-To   better-auth plugins  Mount better-auth plugins through a typed passthrough; bearer and jwt run as-is, table-backed and interactive plugins carry caveats.](https://rickylabs.github.io/netscript/netscript/identity-access/better-auth-plugins/) [How-To   Session lifecycles  Mount public handlers, redirect, handle callbacks, check return URLs, and forward refresh headers across adapters.](https://rickylabs.github.io/netscript/netscript/identity-access/session-lifecycles/) [API Reference   auth backends  Generated symbols for auth, better-auth, kv-oauth, and WorkOS packages.](https://rickylabs.github.io/netscript/netscript/reference/auth/) [API Reference   plugin auth  Generated plugin-auth package symbols.](https://rickylabs.github.io/netscript/netscript/reference/plugin-auth/)

## Learn, do, look up

[Learn  Workspace tutorial  Auth, workspace data, and route authorization in one track.](https://rickylabs.github.io/netscript/netscript/tutorials/workspace/) [Do  Recipes  Task-oriented recipes for this area, one problem each.](https://rickylabs.github.io/netscript/netscript/identity-access/how-to/) [Look up  `@netscript/auth` reference  Generated API reference. Related units: `auth-better-auth`, `auth-kv-oauth`, `auth-workos`, `plugin-auth`.](https://rickylabs.github.io/netscript/netscript/reference/auth/) [Understand  The auth model  The design rationale behind this pillar.](https://rickylabs.github.io/netscript/netscript/explanation/auth-model/)