{
  "schema_version": 2,
  "id": "operate/iris/identity-service",
  "title": "Identity Service",
  "url": "https://redis.io/docs/latest/operate/iris/identity-service/",
  "summary": "Deploy and operate the Identity Service, which issues and checks agent keys for self-managed Redis Iris services.",
  "tags": [
    "docs",
    "operate",
    "iris"
  ],
  "last_updated": "2026-11-03T16:45:14-08:00",
  "children": [
    {
      "id": "operate/iris/identity-service/configuration",
      "summary": "Configure the Identity Service metadata Redis, tenant, service registration, agent-key settings, and TLS.",
      "title": "Configure the Identity Service",
      "url": "https://redis.io/docs/latest/operate/iris/identity-service/configuration/"
    },
    {
      "id": "operate/iris/identity-service/deploy",
      "summary": "Install the Identity Service as its own Helm release, register a service with it, and check that it answers.",
      "title": "Deploy the Identity Service",
      "url": "https://redis.io/docs/latest/operate/iris/identity-service/deploy/"
    },
    {
      "id": "operate/iris/identity-service/authentication",
      "summary": "Understand the Identity Service credentials and roles, let operators sign in with your identity provider, and give IdP users subject grants.",
      "title": "Authentication and authorization",
      "url": "https://redis.io/docs/latest/operate/iris/identity-service/authentication/"
    },
    {
      "id": "operate/iris/identity-service/operations",
      "summary": "Mint, list, rotate, and revoke agent keys, rotate credentials, audit changes, upgrade, back up, and troubleshoot the Identity Service.",
      "title": "Operate the Identity Service",
      "url": "https://redis.io/docs/latest/operate/iris/identity-service/operations/"
    }
  ],
  "page_type": "content",
  "content_hash": "6f46acf4dad060f924bfa6ff305b6962cd38480b38a357e404d3aa3e247e83fb",
  "sections": [
    {
      "id": "overview",
      "title": "Overview",
      "role": "overview",
      "text": "> [!NOTE]\n> The [`redis-iris` suite chart](https://redis.io/docs/latest/operate/iris/self-managed), the supported self-managed install, always installs the Identity Service and registers each service with it. Installing the `iris-identity-service` chart on its own isn't a supported install path. These guides document its values, which you set under the suite chart's `identityService:` key.\n\nThe Identity Service issues the agent keys that applications and agents present to self-managed Redis Iris services, and checks those keys for each service's data plane. Every self-managed Iris service connects to it, and one Identity Service release can serve all of them.\n\nThis guide is for the platform administrator who installs the Identity Service, registers each service with it, and manages agent keys and operator access.\n\n> [!NOTE]\n> The Identity Service needs no license key of its own. Each Iris service you connect to it needs a license. Contact your Redis representative or\n> [contact sales](https://redis.io/contact/)."
    },
    {
      "id": "deployment-options",
      "title": "Deployment options",
      "role": "content",
      "text": ""
    },
    {
      "id": "redis-cloud",
      "title": "Redis Cloud",
      "role": "content",
      "text": "On Redis Cloud, agent keys are managed for you: there is no Identity Service to deploy. Create each service's agent keys in the Redis Cloud console."
    },
    {
      "id": "self-managed",
      "title": "Self-managed",
      "role": "content",
      "text": "Deploy the Identity Service on Kubernetes to run it on your own infrastructure, before or alongside the services that use it.\n\n[Start with the deployment guide](https://redis.io/docs/latest/operate/iris/identity-service/deploy)."
    },
    {
      "id": "which-services-use-it",
      "title": "Which services use it",
      "role": "content",
      "text": "Each of these services' self-managed guides installs the Identity Service as a separate release before the service:\n\n| Service | `product` in grants | `resourceType` in grants | Guide |\n| --- | --- | --- | --- |\n| Agent Memory | `memory` | `mem-store` | [Self-managed Agent Memory](https://redis.io/docs/latest/operate/iris/agent-memory/self-managed) |\n| Agent Playbooks | `playbook` | `playbook` | [Self-managed Agent Playbooks](https://redis.io/docs/latest/operate/iris/agent-playbook/self-managed) |\n| Context Gateway | `context-gateway` | `gateway` | [Self-managed Context Gateway](https://redis.io/docs/latest/operate/iris/context-gateway/self-managed) |\n| Intent Router | `intent` | `intent-router` | [Self-managed Intent Router](https://redis.io/docs/latest/operate/iris/intent-router/self-managed) |\n| Lens | `lens` | `lens-instance` | [Self-managed Lens](https://redis.io/docs/latest/operate/iris/lens/self-managed) |\n\nIf you already run an Identity Service release for one service, register the next service on that release instead of installing a second one. See [Register services](https://redis.io/docs/latest/operate/iris/identity-service/configuration#register-services)."
    },
    {
      "id": "what-you-deploy",
      "title": "What you deploy",
      "role": "content",
      "text": "The `iris-identity-service` Helm chart deploys one Deployment and one ClusterIP Service on port `9200`. The guides install it as release `ids`, so its Service is `ids-iris-identity-service`.\n\n| Component | Purpose | Provided by |\n| --- | --- | --- |\n| Identity Service | Issues, lists, rotates, and revokes agent keys, and checks them for the service data planes. | The chart |\n| Control token Secret | The rescue credential for the Identity Service control API. | The chart generates it, or you supply it |\n| Metadata Redis | Stores the hashed agent keys, their grants, and subject grants. | You |\n| Runtime credentials and internal tokens | Shared Secrets between the Identity Service and each service. | You |\n\nThe chart deploys no Redis, no service, no Ingress, and no NetworkPolicy. The Identity Service has no TLS listener: terminate Transport Layer Security (TLS) in your ingress, service mesh, or load balancer."
    },
    {
      "id": "how-it-fits-with-the-services",
      "title": "How it fits with the services",
      "role": "content",
      "text": "The Identity Service listens on one port and serves three groups of routes. Each group accepts a different credential, sent as `Authorization: Bearer <value>`.\n\n| Route group | Routes | Caller | Credential |\n| --- | --- | --- | --- |\n| Control | `/v1/api-keys`, `/v1/products`, `/v1/subject-grants` | Operators and automation | The control token, or an operator's identity provider (IdP) access token |\n| Runtime | `/v1/auth/*` | Service data planes | The service's runtime credential |\n| Operational | `/health/liveness`, `/health/readiness` | Kubernetes probes and monitoring | None |\n\n1. An operator creates a resource in a service's control plane, such as an Agent Memory store or a Router in Intent Router.\n1. The operator mints an agent key for that resource through the Identity Service control API.\n1. Before it stores the key, the Identity Service asks the service's control plane to confirm that the resource exists and that the actions are valid. This step is called grant validation. It uses the control plane's internal token.\n1. The Identity Service returns the key once. It stores only a hash of the key.\n1. The agent sends the key to the service's data plane. The data plane checks it with the Identity Service, using its runtime credential, and caches the answer.\n\nThe Identity Service keeps no service data."
    },
    {
      "id": "pages-in-this-guide",
      "title": "Pages in this guide",
      "role": "content",
      "text": "- [Deploy](https://redis.io/docs/latest/operate/iris/identity-service/deploy): prerequisites, install, and verification.\n- [Configuration](https://redis.io/docs/latest/operate/iris/identity-service/configuration): the metadata Redis, the tenant, service registration, and the other Helm values.\n- [Authentication and authorization](https://redis.io/docs/latest/operate/iris/identity-service/authentication): credentials, roles, operator sign-in with your IdP, and subject grants.\n- [Operations](https://redis.io/docs/latest/operate/iris/identity-service/operations): the agent-key lifecycle, credential rotation, upgrades, backups, and troubleshooting."
    }
  ],
  "examples": []
}