From prototype to
trusted infrastructure.

A separate identity issuer

Magnexis uses a two-service architecture. The public corporate and developer website runs as a static Netlify deployment. A separately operated Keycloak service provides OpenID Connect authorization, token issuance, key discovery, session lifecycle, and account management. An independent PostgreSQL database persists identity records. HTTPS is terminated at the identity ingress.

What the production source includes

• Isolated services. Keycloak and PostgreSQL are available only on an internal Docker network; only the HTTPS reverse proxy binds public ports.
• Stable issuer configuration. Keycloak starts in production mode with a configured, strict HTTPS hostname and trusted proxy headers.
• Safer first import. The production realm has no test clients, requires email verification, and defaults registration and password recovery to disabled until the mail system is tested.
• Security verification. A CLI smoke test checks discovery metadata, exact issuer identity, authorization code support, S256 PKCE, HTTPS endpoints and published JWKs.
• Branded login. Magnexis’s official emblem and login theme remain isolated from the corporate website assets.

Operator sequence

Before launch, choose an owned identity hostname and server with persistent storage. Create exact DNS records, strong private secrets, automated backups, hardened ingress and restricted administrator access. Configure and verify transactional mail, consent, MFA, incident monitoring, security patching, privacy notices, and account recovery. Then provision one reviewed client per application using exact HTTPS callbacks and S256 PKCE.

cd identity/provider
cp .env.production.example .env
# Replace every placeholder with real values. chmod 600 .env
# Review ingress restrictions, backups, email and DNS first.
docker compose -f compose.production.yaml --env-file .env config --quiet
# Start ONLY after completing server hardening and admin restrictions.
docker compose -f compose.production.yaml --env-file .env up -d
node scripts/verify-issuer.mjs https://auth.your-domain.tld/realms/magnexis

Third-party client onboarding

Third-party sites should use established OpenID Connect clients. Browser applications use Authorization Code with PKCE and must never ship client secrets. Confidential server applications safeguard credentials on the server. The public SDK is a wrapper around an established OIDC client library; it is not the identity issuer. Dynamic client registration and unreviewed signups remain disabled during the prelaunch phase.