Welcome to Gate Identity

Gate Identity is Verne's centralized identity and access control layer. It sits in front of every product in the Verne stack — Relay, Clockwork, and future services — acting as the single source of truth for authentication and authorization.

Instead of sprinkling authorization checks across each microservice or rebuilding login flows for the 10th time, Gate centralizes:

  • Identity (who is calling, including your end-users)
  • Tenancy (which tenant / workspace they belong to)
  • Permissions (what they are allowed to do)

What Gate solves

CapabilityDescription
B2B2C User ManagementProvision, authenticate, and store end-user profiles. Every identity is strictly scoped to your tenant.
Login & Registration flowsPassword-based, social (OAuth), and passwordless (email OTP) flows — all exposed as simple REST endpoints.
Social AuthenticationLet end-users sign in with GitHub, Google, and other OAuth providers. Configure which providers to expose per tenant from the Dashboard.
Settings flowEnd-users can change their password and update profile traits via X-Session-Token-authenticated requests — no separate session infrastructure needed.
Email Verification & RecoveryBuilt-in email verification and account recovery flows, routed through your tenant's identity namespace.
MFA / TOTPOptional per-tenant two-factor authentication via authenticator apps (TOTP). Enable or disable from the Dashboard without any code changes.
Passwordless (OTP)Optional per-tenant passwordless login via email one-time codes. Toggle independently from password-based login.
Identity State ManagementActivate or deactivate end-users instantly. Inactive users are blocked at the Kratos level — no application-level checks needed.
Custom MetadataAttach arbitrary key-value data to any identity via metadata_public. Store plan, company, phone, or any tenant-specific attributes.
WebhooksReceive real-time event notifications for every significant identity event (identity.created, identity.login, identity.password_changed, etc.) with HMAC-SHA256 signature verification.
Policy-first access controlFine-grained permissions expressed as policies that are easy to audit and evolve.
Tenant-aware isolationEvery token and user is strictly bound to a tenant. Cross-tenant data leaks are structurally impossible.

The Identity Model

Gate Identity recognizes three distinct types of actors to keep data perfectly isolated:

  1. Verne Admins: System administrators managing the global infrastructure.
  2. Tenants (You): Our customers who build on top of Verne services. You have API keys and access to the Verne Console.
  3. End-Users: Your customers. They interact with your applications. Gate manages their credentials and profiles, ensuring they are strictly scoped to your tenant_id.

Architecture at a glance

Gate Identity exposes a simple HTTP API that your backend, CLIs, and dashboards talk to. Under the hood, it combines a robust, hardened identity server (powered by Ory Kratos) with our custom high-speed policy engine.

For most teams, the integration surface is small:

  1. For API access: Issue a token, attach it to backend requests, and let Gate enforce access centrally.
  2. For User Auth: Forward your end-users' login/registration payloads to Gate, and we handle the secure storage, password hashing, and session management.

Quick Start

  1. Create a tenant in the Verne Console.
  2. Generate a Gate API key in Dashboard → Keys.
  3. Use that API key to:
    • Provision end-user identities via the /v1/gate/identities endpoint.
    • Start login and registration flows via /v1/gate/auth/login and /v1/gate/auth/registration.
    • Obtain short-lived access tokens for your backend via the /v1/gate/tokens endpoint.

Authentication

Every request to the Gate API must include a Bearer token in the Authorization header. Gate API keys follow a strict format so you can easily identify them in logs or environment variables:

vrn_gate_<environment>_<secret>
PrefixEnvironment
vrn_gate_test_Sandbox — safe for development, local testing, and staging.
vrn_gate_live_Production — access to live tenants, real users, and production data.

Example header:

Authorization: Bearer vrn_gate_live_sk_9f8a7...

Tokens are scoped to a single tenant and environment, and can be instantly rotated from the Dashboard → Keys page.