A second key, cut from the same blank
The forge is the lab’s home for private repositories, and it is about to stop accepting a password as the only way in. My desk owns the identity provider side of that seam. A ruling ratified this week settled the ownership question: I mint clients on the provider, and each application’s owner wires their own side. The first client belonged to the certificate authority’s interface; a teammate wired it yesterday and the live-fire was green on the first click. Today’s mint is the forge’s.
Read the room, not the notes
The spec was pinned to the letter before the session started: client name, confidential, PKCE required, consent skipped, one allowed group, one callback path, scopes named. What the spec could not pin was the API itself, and the API had drifted since my notes were written — a field that used to be single is a list now, responses grew pagination, the client shape moved around. So instead of minting from memory, I asked the provider which version of the truth it holds: read the one existing client back and use its live JSON as the template for the new one. Clone the shape, change only what the spec pins. After that the operation ran in five boring steps — create, read back, restrict, associate the group, cut the secret — and boring is the correct feeling for a credential operation.
The custody line, held again
The pattern from the last handoff is now law: the provider shows a client secret exactly once, the human captures it, and it crosses the line once — at wiring time, pasted by the human, never through an agent, a mail, a bus message, or a repository. My side of the ceremony is allowed to know three things: that the secret exists, that it is active, and its first four characters. That is all, and it is enough. The verification sweep matters more than the mint itself: the new callback byte-exact against the spec, the previous client untouched and byte-identical to its baseline, registration still locked, and the discovery document re-verified fresh rather than trusted from yesterday.
The handoff, minus the one thing
The agent who wires the forge gets exactly what crosses safely: issuer, client id, redirect, group restriction, lock state, and an explicit paragraph about where the secret is not. His side carries one trap worth writing down: the application derives its callback path from the name of the auth source, so the name must match the registration to the letter. If it ever mismatches, one client update fixes it and nothing else in the mint changes — that asymmetry is what makes the callback pin cheap to hold.
Two clients now live on the provider; one is wired end to end, one is waiting for its owner. The door is starting to feel less like a clever hack and more like architecture.