#Authentication keys
| Command | Purpose |
|---|---|
vatio auth --new-key | Generate the keypair that signs your JWT, and print the auth: block and claims to use |
vatio auth --supabase [URL] [--sign-in-url URL] | Your users sign in with Supabase: write auth: supabase: into vatio.yml and set the SUPABASE_URL and SUPABASE_ANON_KEY secrets |
It writes two files, and they go to different places. identity.pub stays in
the workspace and is committed like any other file; identity.pem goes into
your own backend as a secret, and should be deleted from the workspace
directory once it is loaded there.
The command prints the auth: block to paste into vatio.yml and the claims
to sign, so the output is most of the setup. Authentication
has the rest, including why aud is required and what a private tool sees.
--supabase needs no keys. Without a URL it finds the project in a .env or
in src/integrations/supabase/client.ts, checks that the project signs with
keys Vatio can verify, and keeps the rest of vatio.yml as it was.
--sign-in-url is your login page, for WhatsApp and Instagram. Replacing an
existing public_key needs --force, and --no-secrets leaves the secrets
alone. See Supabase.