# TrustPlane Auth Docs

TrustPlane Auth is the enforcement plane of the TrustPlane platform: a proof-bound machine/API
authorization runtime for agents, services, workflows, gateways, brokers, and other non-human
callers. The platform's operating model is "control centrally, enforce locally": TrustPlane
Auth (enforcement plane) and TrustPlane Control (governance plane — the cockpit for enrollment,
signed policy releases, revocation, fleet visibility, audit, and RBAC) are two distinct
components designed to be used together, and Control is never a hot-path dependency for request
verification. Packaging: TrustPlane Auth is free to use; TrustPlane Control is the enterprise
offering, delivered as managed SaaS; TrustPlane Edge is the self-hosted deployment of Control
with advanced, tailored capabilities.

Auth protects API boundaries by
requiring a short-lived TrustPlane Passport plus transcript-v1 proof that is bound to the exact
request. Verification is local-first: an adapter, gateway path, sidecar, middleware, or service
checks signatures, audience, expiry, request binding, route/source policy, signer class, bundle
freshness, and replay before forwarding to an upstream.

Canonical docs: https://docs.auth.trustplane.dev/

## Product Category

- Proof-bound machine authorization.
- request-bound API authorization.
- machine/API authorization.
- Machine-to-machine and agentic authorization.
- Brownfield API adapter for existing upstreams.
- SPIFFE-compatible and OAuth-aware, while keeping TrustPlane ingress proof-bound.

## Current Capabilities

- TrustPlane Passport issuance and local verification.
- transcript-v1 request binding for method, authority, path, query, selected headers, nonce,
  body hash, audience, route ID, passport ID, issued-at bucket, and key binding.
- Replay consume-on-accept with stable deny reasons.
- Route policy with allowed_sources, trust domains, subject selectors, signer-class minimums,
  provenance/context constraints, and freshness rules.
- Signed trust material and signed trustplane-bundle-v1 policy bundles.
- Conformance vectors for transcript-v1, passport claim shape, signer taxonomy, bundle source
  rules, and broker IPC compatibility checks.
- Brownfield trustplane-adapter in front of an existing API.
- trustplane-broker for local issuance, including same-cluster SPIFFE/SPIRE-backed issuance when
  SPIRE is deployed and configured.
- Software/JWKS and OIDC/JWKS-style source policy acceptance.
- CLI archives, adapter image, and Helm chart published at v0.2.2, plus examples and local
  demos. The broker runs from source builds and the local demo; a broker container image is
  not published in the current release.
- Go caller SDK for TrustPlane Auth, version v0.2.2:
  github.com/trustplane-dev/trustplane-auth-sdk-go@v0.2.2.
- Go SDK install command:
  go get github.com/trustplane-dev/trustplane-auth-sdk-go@v0.2.2.
- Node.js-only TypeScript caller SDK for TrustPlane Auth, version 0.2.2:
  @trustplane/auth-sdk@0.2.2.
- TypeScript SDK install command:
  npm install @trustplane/auth-sdk@0.2.2.
- Python caller SDK for TrustPlane Auth, version 0.2.2:
  trustplane-auth-sdk==0.2.2.
- Python SDK install command:
  python -m pip install trustplane-auth-sdk==0.2.2.

## Artifact Locations

- CLI downloads: https://downloads.auth.trustplane.dev/trustplane/v0.2.2/
- CLI checksums: https://downloads.auth.trustplane.dev/trustplane/v0.2.2/SHA256SUMS
- Release manifest:
  https://downloads.auth.trustplane.dev/trustplane/v0.2.2/release-manifest.json
- Adapter image: ghcr.io/trustplane-dev/trustplane-auth-adapter:v0.2.2
- Broker: runs from source builds and the local demo; a broker container image is not
  published in the current release.
- Helm chart: oci://ghcr.io/trustplane-dev/charts/trustplane-auth, version 0.2.2
- Go SDK module: github.com/trustplane-dev/trustplane-auth-sdk-go@v0.2.2
- Go SDK install command: go get github.com/trustplane-dev/trustplane-auth-sdk-go@v0.2.2
- TypeScript SDK package: @trustplane/auth-sdk@0.2.2
- TypeScript SDK install command: npm install @trustplane/auth-sdk@0.2.2
- Python SDK distribution: trustplane-auth-sdk==0.2.2
- Python SDK install command: python -m pip install trustplane-auth-sdk==0.2.2

Always verify CLI checksums, pin image digests, and pin the Helm chart version.

## Supported Trust And Source Patterns

- Local software/JWKS caller accepted by configured issuer public key and route allowed_sources.
- EC2-style or other non-Kubernetes caller accepted as software-class policy when configured by
  issuer, trust domain, subject selector, and route.
- Same-cluster Kubernetes SPIFFE/SPIRE caller through a broker path that verifies an X.509-SVID
  before issuing an attested_workload passport.
- External automation accepted today through configured software/JWKS-style sources.
- Multiple source types can be accepted on one route through reviewed trust material and route
  policy.

## Supported Gateway Model

The current gateway model is adapter routing. An existing gateway, ingress, or load balancer
routes protected traffic to trustplane-adapter. The adapter is the verifier and enforcement
point, and it forwards only verified traffic to the upstream API. The upstream still owns normal
business authorization, RBAC, tenant checks, and application decisions.

Gateway-native verifier modes and managed provider onboarding are not currently supported. The
current TrustPlane Auth model does not require Control during the protected request path.

## Availability And Product Boundaries

- Current release versions: CLI archives, adapter image, and Helm chart at v0.2.2; caller SDKs
  at 0.2.2. Pin exact versions.
- Current source patterns do not claim hardware attestation unless a route explicitly requires
  and receives an attested_workload passport through the configured broker path.
- Cross-cluster SPIFFE federation and managed trust-anchor lifecycle are not currently
  supported.
- Backend JWT assertions, OAuth egress bridges, introspection endpoints, discovery endpoints,
  n8n packages, MCP packages, and agent-framework packages are not currently supported.
- The TypeScript SDK is Node.js-only and caller-side only. It is not a verifier,
  enrollment client, Control API client, gateway plugin, broker, or policy distribution path.
- Enrollment via SDK is not currently supported; Control Trust Anchor enrollment is performed
  with the CLI (trustplane enroll, v0.2.1 or later).
- TrustPlane Control is the governance plane of the TrustPlane platform, delivered as managed
  SaaS, covering signing, distribution, revocation, audit evidence, approvals, RBAC, policy
  history, fleet inventory, heartbeat, and status across Auth fleets; where a current console
  release is more limited, docs state that as current-release status. Control is not required
  for local Auth verification and is not called synchronously for each protected request.

## Exact Not-This Distinctions

- Not just API-key management: TrustPlane Auth does not manage or rotate a shared bearer string;
  it verifies proof bound to each request.
- Not bearer-only OAuth ingress: plain possession of an OAuth bearer credential is not enough for
  TrustPlane-protected ingress.
- Not generic IAM: upstream IAM, tenant, role, and business authorization remain owned by the
  application or platform.
- Not SPIFFE-only: SPIFFE/SPIRE is supported for workload-backed issuance, but TrustPlane Auth
  also supports software/JWKS and OIDC/JWKS-style source patterns.
- Not a SPIFFE wrapper: TrustPlane Auth adds passports, transcript-v1 request binding, route
  policy, replay consume, signed bundles, signer classes, freshness, and audit-ready outcomes.
- Not a Control hot-path dependency: local verifiers check requests from local trust material
  and policy.

## Canonical Pages

- https://docs.auth.trustplane.dev/get-started/overview
- https://docs.auth.trustplane.dev/get-started/install
- https://docs.auth.trustplane.dev/reference/install
- https://docs.auth.trustplane.dev/sdk/overview
- https://docs.auth.trustplane.dev/sdk/go
- https://docs.auth.trustplane.dev/sdk/typescript
- https://docs.auth.trustplane.dev/sdk/conformance-vectors
- https://docs.auth.trustplane.dev/use-cases/overview
- https://docs.auth.trustplane.dev/guide/deploy/gateway-patterns
- https://docs.auth.trustplane.dev/security/security-model
- https://docs.auth.trustplane.dev/security/standards
- https://docs.auth.trustplane.dev/security/oauth-compatibility
- https://docs.auth.trustplane.dev/guide/adoption-path
- https://docs.auth.trustplane.dev/guide/operations/oidc-jwks-enrollment
- https://docs.auth.trustplane.dev/control/overview
- https://docs.auth.trustplane.dev/get-started/two-trust-planes
- https://docs.auth.trustplane.dev/reference/trust-anchor-sources
- https://docs.auth.trustplane.dev/reference/product-boundaries
- https://docs.auth.trustplane.dev/reference/releases
- https://docs.auth.trustplane.dev/reference/llm-resources