Deployment
Ship OutlabsAuth without fighting the schema or cache topology.
Checklist
Postgres
Use postgresql+asyncpg://…. Prefer a direct URL over a transaction pooler
for auth-heavy traffic.
Secret
secret_key must be ≥ 32 characters for HS256.
Schema
Keep auth tables in a dedicated schema (for example outlabs_auth) via
database_schema= / OUTLABS_AUTH_SCHEMA.
Migrate once
auto_migrate=False in multi-worker runtimes. Run the CLI in prestart:
export DATABASE_URL=postgresql+asyncpg://...
export OUTLABS_AUTH_SCHEMA=outlabs_auth
outlabs-auth doctor
outlabs-auth migrate
outlabs-auth seed-system
outlabs-auth bootstrap-admin --email admin@example.com --password '…'
# or: outlabs-auth bootstrap --admin-email … --admin-password …
Redis (or memory cache)
Use Redis for shared permission cache, counters, rate limits, and token
blacklist. Use cache_backend="memory" only on a single process.
Mount prefix
Keep a stable prefix (/v1, /iam, …) and match OutlabsAuth UI
authApiPrefix — see Routers & Prefixes.
Observability
Instrument OutlabsAuth in the API process and expose your host /metrics registry —
Observability.
Maintenance owner
Keep background_job_mode="disabled" in every API replica. Give periodic
cleanup and sync work one external scheduler/worker owner — see
Background Maintenance.
Multi-worker / multi-instance
| Concern | Guidance |
|---|---|
| Migrations | One-shot prestart / release job — never every uvicorn worker |
| Permission cache | redis (+ redis_url) so invalidation is shared |
| Memory cache | Only for single-process hosts |
| Refresh revoke / sessions | store_refresh_tokens=True (default) |
| Immediate access kill | enable_token_blacklist=True + Redis |
| Background maintenance | Disabled in every API process; one external owner per database/environment |
cache_backend="memory" when multiple workers must see each
other's permission invalidations immediately.Health
outlabs-auth doctor is read-only and safe on prod for preflight.
| Exit code | Meaning |
|---|---|
0 | Healthy |
1 | Check / plan failure |
2 | Missing DATABASE_URL |