Authentication & Authorization

Last Updated: 2026-02-04
Content-Type: Explanation
Audience: All

Overview

The Authentication & Authorization system manages user identity, access control, and permissions across the ASO platform.

It supports multiple authentication methods:

JWT authentication for first-party clients (Portal)
DB-backed API keys (user-owned, issued by admin, one-time reveal)
Legacy env API keys for server-to-server compatibility during migration

It also includes an OpenAI-compatible API surface under /v1/* for maximum interoperability with existing clients.

Key Features

JWT Authentication - Token-based user authentication
API Key Authentication - DB-backed keys (Bearer or X-API-Key)
Role-Based Access Control - Carbon, silicon, CSO roles
Hybrid Auth Middleware - Flexible authentication handling
Scope-based permissions - API keys can be scoped per endpoint family

Documentation Structure

Tutorials - Learning guides
How-to Guides - Task instructions
Reference - API reference
Explanation - Architecture

Protocol Routing - Protocol assignment
API Documentation - Endpoint catalog