Skip to content
DataMaker Docs

Self-hosted authentication

Self-hosted DataMaker uses two independent signing domains. Keep them separate so a DataMaker service cannot mint an Automators platform session.

Required trust roots

VariablePurposeServices that receive it
AUTOMATORS_SESSION_PUBLIC_KEYSVerifies Ed25519 platform sessions issued by Automators Auth. Supply comma-separated public keys encoded as base64 SPKI DER.App, API, and standalone AI gateway
DATAMAKER_TOKEN_SECRETSigns DataMaker desktop access tokens and scenario-run credentials with HS256. Generate one random value and retain it across upgrades.API and standalone AI gateway only

DataMaker does not need the private Auth signing key or the legacy shared Auth secret. The API refuses to start when either required trust root is missing or invalid.

Upgrade from the shared Auth secret

Before deploying a release with this trust boundary:

  1. Confirm Automators Auth is issuing Ed25519 platform sessions.
  2. Add AUTOMATORS_SESSION_PUBLIC_KEYS to the app, API, and any standalone AI gateway.
  3. If DATAMAKER_TOKEN_SECRET is already configured, retain its exact value. If it is absent, generate it once with openssl rand -hex 32. Store the same value for the API and standalone gateway, outside any shared service-secret path.
  4. If you introduce a new value on an active installation, stop new token issuance, then allow up to one hour for desktop tokens and 75 minutes for scenario credentials to drain. Alternatively, use a maintenance window. An unused installation has nothing to drain.
  5. Deploy the app, API, and gateway together.

The canonical Compose configuration clears DATAMAKER_TOKEN_SECRET from the app, runner, OpenCode service, database, and initialization job.

Rotation

To rotate an Auth session key, publish both old and new public keys, switch the Auth signer, wait for sessions signed by the old key to expire, then remove the old public key.

Rotating DATAMAKER_TOKEN_SECRET immediately invalidates outstanding DataMaker tokens. Coordinate that rotation with the one-hour desktop and 75-minute scenario credential lifetimes.

For the complete deployment procedure, see the self-hosting guide.