---
title: "Token Flows"
description: "User, API key, refresh-token, and service-account token flows."
source: "Guardian Platform"
---
Auth Service supports several credential flows. Use the flow that matches the user or integration.

## User Sign-In

Users sign in through the configured identity provider. Auth Service validates the provider-issued identity and supplies platform role and membership context to other services.

## API Keys

API keys are for machine access owned by a user or integration. Store them in a secrets manager, rotate them regularly, and revoke them when they are no longer needed.

## Service Accounts

Service accounts are for trusted platform services and backend integrations. They are configured by operators and should not be used as a substitute for human user accounts.

## Token Exchange and Refresh

Keycloak and Microsoft Entra deployments can use Auth Service token exchange and Auth Service-issued refresh tokens. Auth0 and generic OIDC deployments rely on provider-issued tokens and do not expose the token-exchange workflow.

For request and response examples, see [Token Exchange and Refresh Tokens](./token-exchange.mdx#request-format) and [API Keys and Service Accounts](./api-keys-and-service-accounts.mdx#integrity-service-and-the-sdk).

## Related

- [Token Exchange and Refresh Tokens](./token-exchange.mdx) — refresh-token rotation, the reuse window, and troubleshooting
- [API Keys and Service Accounts](./api-keys-and-service-accounts.mdx) — key scopes, project binding, and service-account setup
- [Identity Providers](./identity-providers.mdx) — the provider modes behind user sign-in
- [Authentication and Authorization Guidelines](./guidelines.mdx) — storing, rotating, and revoking credentials