Token Flows
User, API key, refresh-token, and service-account token flows.
Auth Service supports several credential flows. Use the flow that matches the user or integration.
User Sign-In
Users sign in through the configured identity provider. Auth Service validates the provider-issued identity and supplies platform role and membership context to other services.
API Keys
API keys are for machine access owned by a user or integration. Store them in a secrets manager, rotate them regularly, and revoke them when they are no longer needed.
Service Accounts
Service accounts are for trusted platform services and backend integrations. They are configured by operators and should not be used as a substitute for human user accounts.
Token Exchange and Refresh
Keycloak and Microsoft Entra deployments can use Auth Service token exchange and Auth Service-issued refresh tokens. Auth0 and generic OIDC deployments rely on provider-issued tokens and do not expose the token-exchange workflow.
For request and response examples, see Token Exchange and Refresh Tokens and API Keys and Service Accounts.
Related
- Token Exchange and Refresh Tokens — refresh-token rotation, the reuse window, and troubleshooting
- API Keys and Service Accounts — key scopes, project binding, and service-account setup
- Identity Providers — the provider modes behind user sign-in
- Authentication and Authorization Guidelines — storing, rotating, and revoking credentials