Skip to main content
This page describes implemented security controls in the current auth model.

​
Ticket exchange security (/api/auth/pk-ticket)

  1. Validate publishable_key format
  2. Hash key and look up active key record
  3. Resolve org context from key
  4. Enforce per-key allowed_origins (required, no org-level fallback)
  5. If id_token provided: validate signature/issuer/audience using org IDP config
  6. Issue short-lived ticket with org + user identity

​
Publishable key controls

ControlBehavior
Stored formatSHA-256 hash (key_hash), never plaintext
Display formatPrefix only (key_prefix) in UI
RevocationImmediate via revoked_at
Origin restrictionsPer-key allowed_origins (required on every key, no org fallback)
Usage trackingBest-effort last_used_at updates

​
Token validation controls

ClaimValidation
issMust match configured issuer/domain
subRequired for identity mapping
audMust match configured allowed audience(s)
expMust be valid at verification time
Algorithms are limited to asymmetric signatures (no none, no shared-secret algorithm bypasses).

​
Runtime isolation

ComponentIsolation boundary
ThreadManager DOUser/org scoped metadata and connection state
ThreadAgent DOThread-scoped execution state
Tool routingRouted to connection that registered the tool
  • Scope keys by environment (dev/staging/prod)
  • Restrict key origins tightly
  • Revoke keys during incident response
  • Keep IDP issuer/audience config in sync with auth provider
  • Monitor auth failures (INVALID_KEY, origin failures, token failures)

Identity Providers

Authentication