Start the core product
The workspace compose file starts PostgreSQL, the API on port 8080, and the console on port 3000.
docker compose up --buildStart here / Local setup
Run the workspace locally.
Bring up PostgreSQL, the Go API, and the management console, then create the Project boundary that a relying-party application will use.
Local development only. The checked-in compose credentials, insecure cookies, and public ports are not production defaults.
Prerequisites
- Docker with Compose, or PostgreSQL 17 if you run each service manually.
- Go 1.25 for the authoritative backend.
- Node.js 22 for the console, SDKs, examples, and these Astro docs.
Create the Tenant owner
Open http://localhost:3000, create an account, and use a password of at least 12 characters. Signup creates the Tenant and owner in one transaction, then requires a user-verified passkey or hardware security key before the console becomes available.
Create a Project
Choose Sandbox for local work. Define the RP ID, display name, and an exact Origin. localhost and names ending in .localhost may use HTTP; production origins require HTTPS. Because WebAuthn ignores ports when comparing RP IDs, use a distinct name such as customer.localhost when testing a customer RP alongside the management console.
Create a service account and issue a credential
Grant only the scopes the relying-party backend needs, then issue an expiring credential. Copy the secret into its server environment; it is shown only once and must never enter browser code.
Provision a Project User
Create a user inside the Project. The same email may identify unrelated users in other Projects.
Manual backend setup
For backend-only development, copy complicatedauth-backend/.env.example, replace the hash key, and start PostgreSQL before running the server.
cd complicatedauth-backend
set -a; source .env; set +a
go run ./cmd/serverHealth and readiness
| Endpoint | Meaning |
|---|---|
GET /health/live | The Go process is serving requests. |
GET /health/ready | The database responds to a ping. |
Both health operations explicitly declare anonymous access in the canonical contract. Read the production guide before wiring readiness to traffic management.