---
id: w4/m1/t006
title: E2E verify on local mock cluster: identity + client_credentials token
worker: worker4
status: done
estimate: 25m
depends_on: [w4/m1/t005]
---

## Objective

Prove the auth substrate works end-to-end on the local mock cluster: create an identity through the Kratos admin API, register an OAuth2 client in Hydra and complete a `client_credentials` flow, then restart both pods and show the state survives (it lives in the CNPG databases, not in the pods).

## Context

- Mock cluster via `bash scripts/mock-cluster.sh`; kubeconfig at `infra/local/bex.kubeconfig` (gitignored — never print).
- Kratos admin: `POST /admin/identities`; Hydra admin: `POST /admin/clients`, then token via the public `POST /oauth2/token`.
- Capture the exact commands in a small script so t009 (test coverage) and future CI can reuse them.

## Steps

1. Script the flow (`scripts/auth-verify.sh` or extend an existing verify helper): create identity → create OAuth2 client → obtain token → introspect it via Hydra admin.
2. `kubectl rollout restart` Kratos and Hydra; wait Ready.
3. Re-run: the identity still exists; a new token can be issued with the same client.

## Files

- `scripts/auth-verify.sh` (new)

## Acceptance criteria

- [ ] Script exits 0 on the mock cluster: identity created, token issued, introspection returns `active: true`.
- [ ] After pod restarts, identity and client persist and token issuance still works.

## Out of scope

- Browser-based self-service login flows; bex-api calls with the token (w4/m2 t004).
