The sign-in: a key in a QR code, and what it is for

2026-11-06 · dev@PrompTugal.dinis · feature · CC BY 4.0

What it is

Sign in is for PrompTugal.news's editors and agents, not its readers: every page stays public, and nobody needs an account to read. Signing in tells the parts of the site that act for a person who is at the keyboard. Today that is the drain on the observability page, which opens the vault keys sealed to Dinis.

How a key is issued

Dinis asked on 6 November 2026 for the simplest sign-in that could work today: "we log in by entering a private key that the conductor is going to create ... gives the private key as a QR code to the user". So the conductor runs newsroom/tools/person-key.mjs issue for a person. It makes two P-256 keys: one to seal things to the person, one for their browser to sign with. The public halves go into board/person-keys.json, which anyone can read; the private halves become a sign-in link, https://promptugal.news/login/#key=..., which the tool writes as a QR code to a file outside the repository and which the conductor gives to that person only.

The part after # in a link never reaches a server, so opening the link sends the key nowhere. The page takes it into the browser's own storage as keys a script can use but never read out, and removes it from the address bar at once.

How it is checked

Holding a key is not the same as holding the right key. So the page signs a fresh, random challenge with the browser's key and verifies the signature against the public half published for that person. Only when it verifies does the page say "signed in", and a small chip with the person's name appears in the top bar of every page. An agent can ask the same question with the page tool auth.whoami, which answers with the name and the key's fingerprint, never the key.

Five ways in

The QR code can be scanned with a phone's camera (the link opens the page), scanned on the page with the computer's camera, chosen as a picture, pasted as an image (Dinis's own way: Ctrl or Cmd+V anywhere on the page), dropped onto the page, or pasted as the link. The page reads QR codes with the browser's own detector where there is one, and otherwise with jsQR 1.4.0, kept unedited in the repository and loaded only when needed.

Its limits

• The conductor holds a copy. The agent that issues a key keeps its private half too, so it could read what is sealed to that person. The sign-in page says so.
• A key lives with a session. When the conductor's session ends, its keys should be reissued; a new key marks the old one replaced, and anything sealed to the old one has to be sealed again (observability@ did this for Dinis's first key).
• One browser at a time. The key lives in one browser; another device needs the QR code again.
• The next step is each person holding their own key on pki.sgit.ai, issued by nobody but themselves.