Repository navigation
MANUAL RUN: eqosys signing key in 1Password, then deploy #2785
Description
About 5 minutes. Needed before apps get a token from eqosys in production (from the PR for #2766).
- On the office Mac, in the repo:
cd apps/eqosys && bun scripts/keygen.tsprints one private JWK. - Save it in 1Password as
op://eqosys/signing-key/jwk(vaulteqosys, itemsigning-key, fieldjwk). bun run deployfromapps/eqosys.- Check:
curl https://eqosys.qntbr.com/healthsays"tokens":true, andcurl https://eqosys.qntbr.com/.well-known/jwks.jsonlists one key.
Don't set LOOPBACK_RETURNS in production.
Activity
QuinnsCode commentedon Oct 29, 2026
Correction to step 2: save the key in the item's built-in password field, not a custom
jwkfield.apps/eqosys/.env.schemaandrustybuns.config.tsreadop://eqosys/signing-key/password, so ajwkfield would deploy with no signing key ("tokens":false). The other steps are unchanged. No code change is needed; the issue stays open for the owner's hands.eqosys: add the client entry rwsdk's build needs (Part of #2785) (#2847)
eqosys: leave the GitHub and Google sign-in secrets out until their 1…
QuinnsCode commentedon Nov 3, 2026
Answered per the 2026-11-03 audit (#3361).