# `T3.LocalAuth`
[🔗](https://github.com/dl-alexandre/t3-elixir/blob/main/lib/t3/local_auth.ex#L1)

Cached, renewable native credentials for a service on the T3 host.

Add this process before the reader in your supervision tree. It invokes the
installed `t3 auth session issue --json` without a shell or browser, explicitly
requests read scope, and keeps the bearer token in memory. The OS user must
already have access to the intended T3 data directory. This is local control
plane authorization, not an OAuth bypass for remote services.

    children = [
      {T3.LocalAuth, name: MyApp.T3Auth, base_url: "http://127.0.0.1:3773",
       ttl: "24h", label: "board-reader"}
    ]

    connect = fn -> T3.LocalAuth.connection_options(MyApp.T3Auth) end

`connection_options/1` returns RPC options and reuses the issued session until
it is within `:renew_before` milliseconds of expiry (default 60 seconds).
Renewal happens when options are requested, not while an existing socket is
open. Configure `ticket: true` to mint a fresh RPC bearer ticket each time
options are requested; the underlying environment session remains cached.
Set `ticket_cache_ttl: milliseconds` to opt into ticket reuse. Its lifetime is
bounded by this TTL, the server ticket expiry and the underlying session expiry.
The default zero disables ticket caching. CLI-issued credentials are bearer
credentials; DPoP-bound credentials require a new proof for every handshake.
Reconnect readers should call the function for every connection attempt.

Defaults are `ttl: "24h"`, `scopes: ["orchestration:read"]` and
`label: "t3-elixir-local-service"`. `:base_dir` selects the same T3 data
directory used by the localhost server; `:cli` configures the executable and
command deadline. Only loopback HTTP(S) origins are accepted. Renewal revokes
the previous owned session; orderly shutdown attempts to revoke the current
session. Abrupt OS/process termination cannot guarantee revocation: TTL still
bounds the credential lifetime. No token is persisted.

Returned connection options contain a credential: do not log them. Process
status and credential inspection are redacted. The caller owns any separately
issued credential returned by `issue/1` and must revoke it with `revoke/2`.

# `child_spec`

Returns a specification to start this module under a supervisor.

See `Supervisor`.

# `connection_options`

Get fresh RPC connection options, reusing or renewing the owned session.

# `invalidate`

Discard and revoke a cached session, for example after explicit server revocation.

# `issue`

Issue one scoped native session through the local CLI; caller owns revocation.

# `revoke`

Revoke a credential issued by the same local T3 data directory.

# `start_link`

Start a supervised credential provider. Requires a localhost :base_url.

---

*Consult [api-reference.md](api-reference.md) for complete listing*