Connect an application

Access to the private alpha

The documentation is public. The source repositories and SDK packages are private. Ask your Jarvis operator for repository/package read access before running the installation commands. This is separate from your application’s OIDC credentials; signing in to Jarvis does not grant GitLab access.

There is no anonymous package download or self-service access request in this alpha. The links under Canonical sources are for authorized GitLab members, not public downloads.

01 Register02 Install03 Sign in04 Context05 Verify

1. Register your product

Ask the Jarvis operator for a dedicated application registration. Self-service client registration is not exposed in this alpha. Supply:

• Your application name and cookie-isolated HTTPS origin.
• One exact OIDC callback URL on your backend.
• One exact context-return URL on your backend.

You receive your own client_id and client_secret through a secret channel. The operator binds the application to its own stable pairwise sector. Do not reuse the reference application’s client, internal service keys or database credentials.

Choose the origin before you write the callback

Legacy Jarvis cookies still cover k8s1.aviproduction.org. Do not deploy an untrusted external product under that parent domain. Use a separate, owned origin. See the deployment boundary.

2. Install the released SDK

Go

Go 1.25 or later. Configure GitLab read access with your credential manager first. The environment override below applies only to this command; preserve any existing private module patterns your project needs.

Install the Go SDK

GOPRIVATE=gitlab.com/jarvis-ecosystem/* \
  go get gitlab.com/jarvis-ecosystem/jarvisapis/sdk/go@v0.2.0-alpha.1

Continue with the Go sign-in guide →

TypeScript

Configure the package scope in your project. This URL contains no credential:

.npmrc — registry only

@jarvis:registry=https://gitlab.com/api/v4/projects/84278824/packages/npm/

Provide a read-package token through your user-level or temporary CI npm config, using an environment variable. Never commit the resolved token:

Private user or CI config — not source control

//gitlab.com/api/v4/projects/84278824/packages/npm/:_authToken=${JARVIS_PACKAGE_TOKEN}

Install the TypeScript SDK

npm install --save-exact @jarvis/sdk@0.2.0-alpha.1

Choose the browser or server entry point →

3. Wire the identity flow

Two decisions, not oneIdentity first. Context only with consent.

1. Your backend starts sign-in with a random browser-bound state transaction.
2. Jarvis registers or authenticates the user. The backend exchanges the code with PKCE and verifies the identity token.
3. Your product creates or loads its account by (issuer, subject) and sets its own session. Do not use email or an internal Jarvis person ID as the account key.

Use openid and audience jarvis-personal-api. The audience selects the API, not personal fields. The Go SDK implements the OIDC relying-party flow; the TypeScript browser entry point only builds a link to your backend.

4. Ask for context separately

Create a request for the minimum fields and purpose job_application. Save the returned request ID in your user-bound backend operation record, then navigate the user to its consent URL. On return, read the decision from the API; a callback query is not proof of approval.

If approved, request context using the grant and a persisted work-unit ID. The SDK verifies the signed package. If declined, leave the user signed in and let them continue without shared context. Implement the context flow →

5. Prove the negative paths

Before integrating real users, test denied consent, cross-user and cross-app IDs, revocation, changed facts and unavailable authorization. None may return cached context as a fallback. Run the full launch checklist.

You are connected when: identity works independently of consent, the minimum approved fields reach your backend, and the next read stops after revocation.