---
title: "Auth Service Overview"
description: "Public role and responsibilities of Auth Service."
source: "Guardian Platform"
---
Auth Service is the platform service for identity validation, role-based access control, API keys, service accounts, and signing keys used by Guardian Platform workflows.

Users normally interact with Auth Service through Guardian sign-in, membership management, and API key workflows. Operators and integrators interact with it when configuring identity providers, service accounts, token handling, or key management.

## What Auth Service Owns

- Validation of user identity from the configured identity provider.
- Organization and project membership.
- Role and permission checks for platform services.
- User API key lifecycle.
- Service-account token workflows for platform integrations.
- DID key management and signing support.
- Token exchange support for Keycloak and Microsoft Entra deployments.

## What Auth Service Does Not Replace

Auth Service does not replace the customer identity provider. The identity provider remains the source for user sign-in. Auth Service enriches platform requests with roles, permissions, memberships, and platform-specific keys.

## Supported Identity Provider Modes

Auth Service supports Keycloak, Auth0, Microsoft Entra, and generic OIDC-capable provider configuration. The deployment chart documents Auth0, Microsoft Entra, and Keycloak as customer deployment choices.

Token exchange and Auth Service-issued refresh tokens are available only for Keycloak and Microsoft Entra deployments. Auth0 and generic OIDC deployments rely on provider-issued tokens for user authentication.

## Related

- [Identity Providers](./identity-providers.mdx) — the supported providers and what each one supports
- [RBAC and Membership](./rbac-and-membership.mdx) — each role's permissions and how membership is managed
- [API Keys and Service Accounts](./api-keys-and-service-accounts.mdx) — key scopes, project binding, and service-account setup
- [Token Flows](./token-flows.mdx) — which credential flow fits each user or integration
- [Key Configuration](./key-configuration.mdx) — supported key providers for DID signing
- [Auth Service Configuration](./configuration.mdx) — the deployment settings Auth Service needs