Security / identity
Credentials are narrow, revocable, and organization-bound.
Server automation uses scoped API keys. Hosted agent clients use OAuth authorization code with PKCE S256, explicit consent, resource indicators, and audience-bound access tokens.
API keys
Keys are shown once, stored as keyed hashes, and independently scoped, expired, rotated, and revoked.
- Keep keys in a server-side secret manager.
- Use separate credentials per environment and workload.
- Never place a key in browser code or a public build variable.
OAuth client flow
Discover authorization metadata from the protected resource, register or identify the client, send an exact redirect and S256 challenge, show consent, and exchange the code for a resource-bound token.
- State protects the browser return.
- Refresh tokens rotate on use.
- Reuse revokes the grant family.
- Revocation is checked during access-token verification.
Scope map
Request only the operations the user intends to delegate.
- capabilities:read for discovery
- jobs:write and jobs:read for normal creation
- outputs:read for retrieval
- jobs:cancel for cancellation
- jobs:delete for destructive deletion
Failure handling
Treat 401 as missing, invalid, expired, or revoked credentials. Treat 403 as an authenticated client lacking scope or ownership. Do not loop on either response.