statecraft.
Catalog/rahi

025-api-tokens-and-resource-server

The resource server: bearer tokens rauthy issued, audience bound, scope gated, never app minted

Lifecycle approvedImplementation completeVerification unknownQualification unknown

A browser is not the only client. Command line tools, agent runtimes, and MCP clients hold no cookie and cannot follow a redirect into a browser session, and the chassis has so far had nothing to say to them. This spec makes the app an OAuth 2.1 resource server over the same IdP: it publishes protected resource metadata so a client can discover the authorization server, validates rauthy-issued JWT access tokens locally against the cached JWKS with a mandatory audience check, gates routes on scope, and answers an unauthenticated request with the challenge that bootstraps discovery. Registration and the grants themselves stay rauthy's: the app issues no API key, ever.

Read the full pinned specification ↗

Relationships

Claimed units

  • establishes
    {
  "kind": "file",
  "path": "crates/rahi-idp/src/resource.rs"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/rahi-idp/src/bearer.rs"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/rahi-idp/src/scope.rs"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/rahi-idp/src/registration.rs"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/rahi-idp/tests/bearer.rs"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/rahi-idp/testdata/tokens/"
}
  • extends
    {
  "nature": "additive",
  "spec": "021-idp-proxy-and-discovery",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-idp/src/lib.rs"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "022-session-and-principal",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-idp/src/extractor.rs"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "022-session-and-principal",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-idp/src/session.rs"
  }
}
  • constrains
    {
  "flavor": "invariant-freeze",
  "note": "the app mints no credential; rauthy is the only issuer, cookie or bearer",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-idp/src/principal.rs"
  }
}

Source headings

  1. 025: The resource server
  2. 1. Purpose
  3. 2. Territory
  4. 3. Behavior
  5. 4. Functional requirements
  6. 5. Acceptance criteria
  7. 6. Out of scope
  8. 7. Resolved decisions
  9. 8. Status
  10. Verification

Frozen anchors

No frozen anchors declared.