Summary

  • RIPE NCC says its database website now uses OIDC authentication in place of the old Crowd cookie. Database release 1.124 had added OIDC support in production on 27 August 2026.
  • A signed-in editor reaches the web workflow; the maintainer's auth: SSO record determines whether that account can change an object. Scripted API keys have their own credential path.

The cookie has left the registry building. In its 23 October member update, RIPE NCC says the RIPE Database website now authenticates with OIDC and has replaced the previous Crowd cookie. The software had prepared the doorway earlier: database release 1.124 lists OIDC support and a 27 August production deployment. October's news is the website change, not the birth of the underlying protocol.

For the operator who must edit a resource record, the story has two doors. First, a person signs in with RIPE NCC Access. Then the database checks the relevant maintainer. RIPE's authorisation guide says the Access account's email address is the SSO credential in a mntner object, and web-based updates use that SSO authorisation. A fresh browser session can therefore get an editor to the form; the maintainer entry decides whether the edit has a signer. The record is the hinge, not the decoration on the login screen.

Automation has a different pocket for its keys. RIPE's guide describes API keys as credentials tied to an Access account and used for scripted database updates. That account must be present on a maintainer through auth: SSO. The October notice announces a website cookie replacement; it gives no new API-key conversion date. Teams with both humans and scripts can check each route separately instead of discovering an abandoned maintainer address during an urgent registry edit.

The immediate work is mundane and worth doing: sign in to the database site, find a record your team actually maintains, confirm the intended Access account appears on its maintainer, and keep the API-key inventory tied to named accounts. When a contact or route object needs correcting at speed, a cookie retirement should be a line in a change log, not the headline of an outage.