Skip to main content
This page describes implemented security controls in the current auth model.

​
Ticket exchange security (/api/auth/pk-ticket)

  1. Validate publishable_key format
  2. Hash key and look up active key record
  3. Resolve org context from key
  4. Enforce per-key allowed_origins (required, no org-level fallback)
  5. If id_token provided: validate signature/issuer/audience using org IDP config
  6. Issue short-lived ticket with org + user identity

​
Publishable key controls

​
Token validation controls

Algorithms are limited to asymmetric signatures (no none, no shared-secret algorithm bypasses).

​
Runtime isolation

  • Scope keys by environment (dev/staging/prod)
  • Restrict key origins tightly
  • Revoke keys during incident response
  • Keep IDP issuer/audience config in sync with auth provider
  • Monitor auth failures (INVALID_KEY, origin failures, token failures)

Identity Providers

Authentication