For: Operators.
Prereqs: A deployed authserver (see Deploy guides) with admin.enabled: true and an admin API key. Concept background: Architecture, Threat model.
Day-2 operations: clients, users, resources, grants, signing keys, forensic queries, incident response.
- Export the admin API key once per shell.
export AUTHPLANE_ADMIN_API_KEY="$(openssl rand -hex 32)"if you are bootstrapping; otherwise copy it from your secret store. - The admin server listens on
admin.address(default:9001). Never expose this port to the internet. Keep it behind a VPN, an internal LB with allowlisted source IPs, or an mTLS terminator. - The Admin UI lives at
http://<admin-host>:9001/admin/ui/. CLI, REST, and UI share the same service layer — every mutation emits the same audit row regardless of surface.
- Admin CLI — the operator's daily driver. Every
authserver admin …subcommand, cross-linked todocs/reference/cli.md. - Admin UI tour — the visual surface at
:9001/admin/ui/; page-by-page map to the scripted commands. - Key rotation — signing-key lifecycle, keyfile vs.
postgres_keyvs. Vault Transit, JWKS propagation. - Audit & forensics — query the audit log for incident reconstruction; covers the canonical action names and detail-string format.
- Token design (operator view) — what the AS emits, what to monitor, lifetimes per token kind, refresh-token reuse detection.
- Incident runbook — five named scenarios with Symptoms / Detect / Contain / Eradicate / Recover / Post-incident.
- Every CLI subcommand cited inline cross-links to
docs/reference/cli.md. - Every HTTP route cross-links to
docs/reference/http-api.md. - Every audit-action name is the canonical string from
internal/domain/audit/entity.go. - Every metric name is the canonical instrument name from
internal/observability/metrics.go.
- Deploy → Backup & purge — scheduled cleanup (a deploy-time decision).
- Deploy → Observability — wire Prometheus / OTel before going to production.
- Concepts → Threat model — the failure modes the audit log lets you investigate.