Eve Auth And Secrets

Handles the full authentication and secrets lifecycle for Eve deployments: logging in via SSH or Nostr challenge-response, managing JWT tokens, rotating project secrets, and wiring up SSO for your deployed apps. You'll reach for this when setting up new projects, troubleshooting auth failures, or configuring org invites and access groups. The standout piece is the OAuth sync workflow that pulls your local Claude and Codex tokens into Eve secrets so agents can use them during builds. It supports multiple identity providers out of the box and includes token minting for service accounts. The permissions model is live-resolved from the database rather than relying on stale JWT claims, which means role changes take effect immediately.

skills.sh installs: 332
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add incept5/eve-skillpacks --skill eve-auth-and-secrets --agent claude-code

Installs into .claude/skills of the current project.

Files

Eve Auth and Secrets

Use this workflow to log in to Eve and manage secrets for your app.

When to Use

Setting up a new project profile
Authentication failures
Adding or rotating secrets
Secret interpolation errors during deploys
Setting up identity providers or org invites
Adding SSO login to an Eve-deployed app
Setting up access groups and scoped data-plane authorization
Configuring group-aware RLS for environment databases

Authentication

eve auth login
eve auth login --ttl 30                # custom token TTL (1-90 days)
eve auth status

Challenge-Response Flow

Eve uses challenge-response authentication. The default provider is github_ssh:

Client sends SSH public key fingerprint
Server returns a challenge (random bytes)
Client signs the challenge with the private key
Server verifies the signature and issues a JWT

Token Types

Type	Issued Via	Use Case
User Token	`eve auth login`	Interactive CLI sessions
Job Token	Worker auto-issued	Agent execution within jobs
Minted Token	`eve auth mint`	Bot/service accounts