Skip to content

Cbox ID — operator documentation

Cbox ID — operator documentation

This is the operator manual for running the deployable Cbox ID app — the thing you self-host. It covers deploying, configuring, and operating the platform.

Building against Cbox ID (integrating an app, OAuth/OIDC/SCIM, entitlements)? That's the framework documentation, which ships inside the cboxdk/laravel-id package (github.com/cboxdk/laravel-id) — start with its Start here guide.

Cbox ID is a separate repository from the framework it composes. Because there is no shared checkout, references into the framework docs use canonical public URLs on github.com/cboxdk/laravel-id, never relative ../ paths. If you have the package installed, the same files live under vendor/cboxdk/laravel-id/docs/.

Start here

Configure and run

  • Configuration — every environment variable that matters, and the secure defaults this app ships with.
  • Operations — deployment and day-2: backing up the crypto key, key rotation, the health check, audit/monitoring, upgrades, and break-glass.
  • Security — the operator-facing security surfaces and the system-level compliance view.

The two-minute version

composer install --no-dev --optimize-autoloader
php artisan cbox-id:install     # generates keys, asks the few questions, migrates
php artisan cbox-id:doctor      # confirms everything is healthy, in plain language

Then serve behind TLS, run the queue worker and scheduler, and back up CBOX_ID_CRYPTO_KEY somewhere separate from the database — losing it makes sealed secrets unrecoverable. Details in Operations.

What this app is

The deployable app built on cboxdk/laravel-id. The framework package provides the identity engine (crypto, tenancy, OAuth/OIDC, SCIM, SAML, audit); this app adds the admin console, onboarding, and hosted-cloud concerns. It's server-rendered (Livewire + Volt) on purpose — session-cookie auth, minimal JS, no tokens in the browser — because it is the login surface.

Next → Quickstart