Configuration
Every block below is compared character by character with the source file named above. If they drift apart, the documentation build fails.
export interface AuthConfig {export function parseAuthConfig(value: Record<string, unknown>): AuthConfig {readonly originProviders: Readonly<Record<string, string>>;Configuration belongs to the host application, not to a workflow. Database, OIDC, webhook, connector, and provider credentials live in the target environment or an untracked local file.
Never put a credential into a workflow definition, an event payload, or a screenshot. An event is immutable — a secret that reaches one is a secret you cannot delete.
The host maps auth.oidc.origin through identity.originProviders to a
provider ID. A configuration with no mapping for an origin is rejected outright
rather than defaulted, which is what you want: a silent default here would route
logins to the wrong provider.
There is no IDENTITY_FLOW_LICENSE_FILE and no licence step in 0.2.0. If an
older instruction mentions one, it’s out of date.
The second copy in the deployment exercise gets its own configuration and its own PostgreSQL state. Set its values explicitly — don’t let it inherit from the first copy, or you’re testing one target twice. Confirm it starts before comparing anything.
When you add an override, check where it comes from and what beats what in the source file quoted above. This page will not guess a default for your environment, because a wrong guess here is silent.
See Deployment for the boundary and Troubleshooting when an origin or provider doesn’t resolve.