Cached, renewable native credentials for a service on the T3 host.

Add this process before the reader in your supervision tree. It invokes the installed t3 auth session issue --json without a shell or browser, explicitly requests read scope, and keeps the bearer token in memory. The OS user must already have access to the intended T3 data directory. This is local control plane authorization, not an OAuth bypass for remote services.

children = [
  {T3.LocalAuth, name: MyApp.T3Auth, base_url: "http://127.0.0.1:3773",
   ttl: "24h", label: "board-reader"}
]

connect = fn -> T3.LocalAuth.connection_options(MyApp.T3Auth) end

connection_options/1 returns RPC options and reuses the issued session until it is within :renew_before milliseconds of expiry (default 60 seconds). Renewal happens when options are requested, not while an existing socket is open. Configure ticket: true to mint a fresh RPC bearer ticket each time options are requested; the underlying environment session remains cached. Set ticket_cache_ttl: milliseconds to opt into ticket reuse. Its lifetime is bounded by this TTL, the server ticket expiry and the underlying session expiry. The default zero disables ticket caching. CLI-issued credentials are bearer credentials; DPoP-bound credentials require a new proof for every handshake. Reconnect readers should call the function for every connection attempt.

Defaults are ttl: "24h", scopes: ["orchestration:read"] and label: "t3-elixir-local-service". :base_dir selects the same T3 data directory used by the localhost server; :cli configures the executable and command deadline. Only loopback HTTP(S) origins are accepted. Renewal revokes the previous owned session; orderly shutdown attempts to revoke the current session. Abrupt OS/process termination cannot guarantee revocation: TTL still bounds the credential lifetime. No token is persisted.

Returned connection options contain a credential: do not log them. Process status and credential inspection are redacted. The caller owns any separately issued credential returned by issue/1 and must revoke it with revoke/2.