Skip to content
Sudomimus

Use public-key sign-in

View as Markdown

Public-key sign-in is a good fit for a service that already has reliable key storage and signing support. You generate an Ed25519 key pair in your own system and register only the public half with Sudomimus. The private key stays with you.

If you mainly want the quickest setup, an access key is usually easier.

Generate a key pair in the portal

Section titled “Generate a key pair in the portal”

The With portal can generate the key pair on macOS, Windows, and Linux:

  1. Open Programmatic access → Public keys, then select Create.
  2. Select Generate key pair on this device.
  3. Download and store the private-key file. The portal enables saving only after the download.
  4. The public JWK is filled in automatically.

Generation happens in the current browser. Only the public key is submitted to Sudomimus.

Generate a key pair from the command line

Section titled “Generate a key pair from the command line”

If OpenSSL is installed, generate an Ed25519 private key and its matching SPKI public-key PEM directly:

macOS and Linux

Section titled “macOS and Linux”

Run this in Terminal:

Terminal window
openssl genpkey -algorithm Ed25519 -out sudomimus-ed25519.private.pem
openssl pkey -in sudomimus-ed25519.private.pem -pubout -out sudomimus-ed25519.public.pem
chmod 600 sudomimus-ed25519.private.pem

Windows

Section titled “Windows”

Run this in PowerShell:

Terminal window
openssl genpkey -algorithm Ed25519 -out sudomimus-ed25519.private.pem
openssl pkey -in sudomimus-ed25519.private.pem -pubout -out sudomimus-ed25519.public.pem

These commands create private- and public-key PEM files. Paste the contents of sudomimus-ed25519.public.pem into the With portal; the portal converts it to the public JWK used by Sudomimus in the current browser. Place the private-key file in the service that will use it, and never paste or upload the private key.

The portal also continues to accept an existing exact Ed25519 public JWK { "kty": "OKP", "crv": "Ed25519", "x": "..." }.

Register a public key

Section titled “Register a public key”

Prepare the application or sector anchors the key should cover. Then, in with.sudomimus.com:

  1. Open Programmatic access → Public keys.
  2. Select Create and enter a name that identifies its purpose.
  3. Choose your account, an agent, or an automation as the principal.
  4. Generate a key pair on the current device or paste an existing Ed25519 public-key PEM/JWK. Never paste the private key.
  5. Enter the application or sector anchors that may use the key, and add an expiry if needed.
  6. Save the key, then configure the service to sign in with the matching private key.

The target application must support public-key sign-in. The application developer or organization administrator provides the required application or sector anchors.

Application and sector coverage

Section titled “Application and sector coverage”
  • An application anchor limits the key to that application.
  • A sector anchor covers applications in that sector, including applications added later.

Coverage determines where the key may be used to sign in. It does not grant permissions inside those applications. Coverage cannot be edited after registration. To change it, register a replacement, switch the service, and revoke the old key.

Storage and rotation

Section titled “Storage and rotation”
  • Keep the private key in an operating-system keychain, hardware security device, or protected key service.
  • Never paste it into the With portal, a chat, a ticket, or a source repository.
  • Use separate keys for separate environments so a test-system leak does not affect production.
  • If the private key is lost or may have leaked, revoke the public key entry and register a replacement immediately.
Section titled “Related”