Tutorials & samples

Learn Sentinel by building.

Hands-on guides for everything Sentinel does — logins and passkeys, the permission grammar, refresh-token families, multi-org tenancy, workload identity, migration. Each article is written against the real implementation; companion sample projects land alongside the demo wave. Pick the capability you need below.

Getting Started

1 article

001

Your first login

Stand up a Sentinel host from nothing — EF stores, the engine, the authentication handler — and walk a real login, refresh and authenticated request through it.

Authentication & Factors

1 article

004

Passkeys, first-class

Register a passkey, sign in without a password, and use a passkey as a second factor — the full WebAuthn ceremony flow with Sentinel's eligibility rules, sign-count defense and phishing-resistant session marking.

Authorization Engine

1 article

002

The permission grammar, evaluated

Learn service:scope:action from the inside — patterns and wildcards, deny-overrides, org/team/self scoping, ABAC conditions, and the golden vectors that make the server and the browser agree.

Tokens & Sessions

1 article

003

Refresh-token families

Why every refresh rotates, what a token family is, and how replaying a stolen token detonates the whole lineage — with the exact service, store contract and tests behind it.

Enterprise SSO & Federation

1 article

005

Multi-org membership & delegated admin

Model realm → organizations → teams, put one user in two orgs, switch org context without re-login, and hand each org an admin who structurally cannot touch the other — the fence lives in the evaluator, not the controller.

Machine Identity

1 article

007

Workload identity federation

Delete the deploy secrets — configure a trust for GitHub Actions or Kubernetes OIDC tokens and exchange them for short-lived Sentinel access tokens, with wildcard subject matching and audited denials.

Operations & Administration

1 article

006

An OIDC server inside your app

Turn the host you already have into a standards-compliant OIDC provider — discovery, a confidential client, the code + PKCE flow with your own login UI, introspection and back-channel logout.

Compliance & Migration

1 article

008

Shadow-mode migration

Import your users, run Sentinel's evaluator silently beside your legacy authorization, turn every disagreement into a reviewable event, and cut over only when the divergence counter reads zero.