1# Tickets23A ticket is a serializable object that packages the information required for an operation.4dev.site passes tickets between the browser, CLI, control plane, and daemon. Each ticket5type defines its own use count, lifetime, binding, storage, and revocation rules.67The control plane issues most tickets. It stores a SHA-256 hash for opaque bearer tickets.8It cannot recover their plaintext values. Signed tickets carry their own claims and signature.910## Ticket inventory1112| Ticket | Purpose | Issuer | Consumer | Uses | Lifetime | Binding | Storage | Revocation |13| --- | --- | --- | --- | --- | --- | --- | --- | --- |14| `dmt_…` | Enroll one machine | Control plane, at a signed-in user's request | CLI and control plane | One | Until enrollment or revocation | The enrolled machine endpoint after redemption | Control plane hash, then CLI input | Revoke the named machine entry before use |15| `dsm_…` | Authenticate one enrolled machine | Control plane after enrollment | CLI, daemon, and control plane | Many | No automatic expiry | Bearer ticket for one named machine. Enrollment and daemon registration also require endpoint proof. | CLI private `config.json`, control plane hash | Revoke the machine ticket |16| `dst_…` | Start one service connection | Control plane, at an authorised browser's request | `devsite connect` and control plane | One | Two minutes | One viewer and service. The session then binds to the client endpoint. | CLI input, control plane hash | Consume or expire the ticket. Removing access also prevents redemption. |17| `dss_…` | Request stream capabilities | Control plane after `dst_…` redemption or approved delegated access | Connector and control plane | Many | Eight hours. Delegated sessions last at most 15 minutes. | Client endpoint. Also tied to its issuer credential when delegated. | Connector memory, control plane hash | Delete or expire the session. Revoke its issuer credential, resource, account, or access. |18| `dsp_…` | Carry one reviewed delegated approval | Control plane signing key | Granting client and control plane | One grant for one request id | Limited by request and grant expiries | Request id, service, issuer ticket, resource, requester endpoint, and expiries | Caller-provided plan file or memory. It has no server-side plaintext row. | The ticket cannot create a grant after its request or grant expires. Revoke the issuer ticket or underlying access. |19| Stream ticket (signed capability) | Open one service stream | Control plane signing key | Daemon | One | Three minutes | Client endpoint, daemon endpoint, viewer, resource, and `TcpConnect` permission | Connector memory and stream handshake | Its nonce is consumed once. The daemon closes streams after access revocation or a stale authorisation snapshot. |20| Browser session | Keep a user signed in to the website | Control plane after sign-in | Browser and control plane | Many | Seven days | Bearer ticket with no endpoint-key binding | HttpOnly browser cookie and control plane hash | Log out or let the ticket expire |2122## Machine enrollment ticket: `dmt_…`2324A signed-in user creates a named `dmt_…` ticket on the dashboard. The ticket can carry25machine scopes such as `service_grants:issue`.2627The CLI presents the ticket with a public endpoint key and proof from its matching private28key. The control plane atomically consumes the ticket, binds the machine entry to that29endpoint, and returns a `dsm_…` machine ticket.3031`dmt_…` tickets have no automatic expiry. Create one when needed and use it promptly. A32leak can enroll one endpoint until use or revocation. Successful enrollment prevents reuse.3334## Machine ticket: `dsm_…`3536The `dsm_…` ticket lets the CLI and daemon make authenticated control-plane requests. It37does not travel over an Iroh service connection. Enrollment and daemon registration also38require proof from the persistent Ed25519 endpoint key.3940The CLI stores this ticket in private `config.json`. The control plane stores only its hash.41Revoking it stops later authenticated use, unregisters its bound daemon, and deletes its42delegated tunnel sessions.4344## Service connection ticket: `dst_…`4546An authorised browser creates a `dst_…` ticket for one viewer and service. It expires after47two minutes. `devsite connect` creates a new Iroh endpoint key in memory and redeems the48ticket with that public endpoint id.4950The control plane atomically deletes the ticket, checks current access, and returns a51client-bound `dss_…` tunnel ticket. The connector does not save it. It keeps the value only52in memory and deletes the session on a clean shutdown.5354## Tunnel ticket: `dss_…`5556A `dss_…` ticket lets one connector request a capability for each local TCP connection. An57ordinary connection ticket creates an eight-hour session. A delegated approval creates a58session that lasts at most 15 minutes.5960The control plane binds the ticket to the client endpoint key. A delegated session also61links to the issuer credential. The control plane stores its hash and checks access before62it issues every capability.6364## Approval ticket: `dsp_…`6566A requester creates a signed request with an `agr_…` id, a service keyword, a temporary67endpoint, an expiry, and a private-key signature. The granting party asks the control plane68to resolve the request and issue a `dsp_…` ticket.6970This ticket is a signed approval snapshot. It names the request id, service, issuer ticket,71chosen resource, requester endpoint, and expiries. The control plane verifies the request72proof again when it plans or applies the grant. The ticket cannot open a service stream.73Applying it creates at most one `dss_…` ticket for its request id.7475The ticket has no server-side plaintext row. The caller can keep it in a plan file or76memory. Expiry, issuer-credential revocation, and access revocation stop a later grant.7778## Stream ticket: signed capability7980The connector uses a `dss_…` ticket to request one signed capability for one local TCP81connection. The control plane signs the capability with its private signing key. The daemon82pins the matching public key and uses it during the Iroh service handshake.8384The ticket names the viewer, resource, client endpoint, daemon endpoint, and `TcpConnect`85permission. It expires after three minutes. The daemon accepts its nonce once and rejects a86different endpoint. It closes active streams when its authorisation snapshot is stale or no87longer permits the stream.8889## Browser session ticket9091A browser session ticket keeps a user signed in to the dashboard for seven days. The browser92stores it in an HttpOnly cookie. The control plane stores its hash. Logout or expiry ends93its use.9495## Tickets and secrets9697Treat complete `dmt_…`, `dsm_…`, `dst_…`, and `dss_…` values, browser cookies, and live98signed capabilities as secrets. Redact them from logs, screenshots, shell history, and agent99transcripts.100101Keep a `dsp_…` ticket inside its approval workflow. It cannot open a connection by itself,102but it records a reviewed decision. `acct_…`, `res_…`, `machine_…`, `agr_…`, handles, and103endpoint ids are identifiers. They do not grant access by themselves.104105See [Keys and endpoint identities](keys-and-identities.md) for the private keys that bind106some tickets to Iroh endpoints.