Securing your host (owner auth)

Carabase Host ships an owner-authentication layer — OAuth2 with WebAuthn passkeys and recovery codes — that is off by default. Out of the box everything works the way the rest of this section describes: no public ports, requests authorized by reaching the host over Tailscale plus the workspace header. You don’t need to touch any of this to finish onboarding.

The OWNER CLAIM CODE in your startup log

While a workspace has no registered passkey, the host prints a block like this to its console at every boot:

OWNER CLAIM CODE (My Workspace)
  XXXXXXXX
  expires 2026-…
  open https://…/admin

It’s not an error, and nothing is waiting on it. The code is a short-lived, single-use credential for claiming ownership — you only need it the day you decide to set up passkeys. It’s replaced on restart and only ever printed to the local console; never paste it into chat, email, or an issue.

Turning enforcement on (the safe order)

Enrollment happens through the host’s own server-rendered sign-in page, reached via the OAuth authorize flow (the Admin shell hands you off to it) — there is no separate Admin SPA form for the first claim.

1. Register a passkey and save your recovery codes first. Open /admin/ at the exact configured issuer origin, enter the console claim code, register a passkey, and store the one-time recovery-code set offline.
2. Verify a fresh passkey sign-in works.
3. Then enable enforcement — from Admin → Advanced → Owner Auth, or POST /api/v1/auth/enforcement with an owner bearer. The endpoint refuses with 409 auth_not_ready until at least one passkey and one unused recovery code exist, so flipping it too early can’t lock you out. Never set the flag via raw SQL — that bypasses the guard.

With enforcement on, API clients must present bearer tokens; header-only clients — including the current carabase CLI — stop working. Keep enforcement off on hosts you drive from the CLI.

Passkeys from another device need a stable HTTPS origin (Tailscale Serve); on the same machine, http://localhost:3000 works via the WebAuthn loopback exception. The full production procedure — issuer configuration, phased rollout, recovery, break-glass — lives in the owner-auth runbook.