Anonymous

Official plugin — issue a user-plane session with a random id and no password.

anonymous() creates a throwaway principal: one public Flow returns hybrid session tokens for a new random userId. Use it for guest carts or try-before-account flows.

The one rule

Enable gate.auth, then .plug(anonymous()). Treat the session like any other Bearer principal — gates still decide what it may do.

Quick start

Plug it

src/app.ts

import { oke } from "okengine";
import { anonymous } from "okengine/plugins";

export const app = oke({
  name: "shop",
  env: "dev",
  gate: { auth: {} },
}).plug(anonymous());

const { data } = await api.auth.signInAnonymous();
// data.userId is a fresh OKID; store tokens like any other session

POST /auth/sign-in/anonymous — no body.

Gate what guests can do

Attach real policies to guest-capable Flows (gate.scope, custom policies). Anonymous only issues a session — it does not grant scopes.

Options

Option	Type	Default	Meaning
`secret`	`string`	active*	HMAC secret (*from `gate.auth` when plugged after `oke()`)
`sessions`	`SessionStore`	active*	Session store shared with Gate auth
`now`	`() => number`	`Date.now`	Injectable clock
`emailDomain`	`string`	—	Reserved; unused in v1