Feature Machines and Agents

Authorize a machine the way you authorize a person

A service gets its own credential, its own roles and a short-lived token. An agent acting for someone gets a token that names both of them, and reaches only what both hold.

Own roles at your nodes Both must allow for agents Every exchange in the audit log

Machine clients

Give each service its own credential

A machine client signs in as itself with the client credentials grant, and your API authorizes it with the same checks it uses for people.

Short-lived access tokens, with a lifetime you set

Permissions on the token from the roles it holds

Your API verifies it the same way as a person's token

POST /oauth/token

grant_type=client_credentials
client_id=…
client_secret=…
audience=https://api.example.com

Roles and scope

Hold a machine to what it needs

A machine client is a principal of its own, not a shared key with broad access.

Roles at your nodes

Assigned like a person's roles, and held to the same limit on what can be granted.

Pinned to one organization

A client can act inside a single customer, and hold roles nowhere else.

Audiences

Each token names the API it is for, from the audiences the client may ask for.

Agents acting for a person

Let an agent act for someone, as both of them

With token exchange, a machine client swaps a signed-in person's token for a delegated one. It names the person and the client, so your API always knows who asked and what acted.

Switched on per client

The person must still be signed in and active

Accepted only on the routes you choose in your own API

POST /oauth/token

grant_type=urn:ietf:params:oauth:grant-type:token-exchange
subject_token=<the person's access token>
subject_token_type=urn:ietf:params:oauth:token-type:access_token

Both must allow

An agent never reaches further than the person, or itself

A delegated token carries only the permissions both hold, and a check can name the acting client so both are asked.

Dana, using a support agent

Dana can read and refund invoices. The agent can read invoices and read reports.

invoice.read: both hold it Allowed

invoice.refund: only Dana holds it Refused

report.read: only the agent holds it Refused

Keeping control

Change your mind at any time

What a machine can do follows what you set, and every use of it leaves a record.

Secret rotation

Rotate a secret while the old one keeps working for a window, so nothing breaks mid-deploy.

Take access away

Deactivating a client or removing a role applies at its next token request.

Recorded

Every exchange, issued or refused, is in the audit log under the client, naming the person.

Your customers' integrations

Let customers connect their own systems

When you allow it, an organization creates credentials for its own systems from the hosted portal.

Only the roles you list can be held

Always pinned to that organization

Switched on by you, per Environment

Integrations page

In the hosted portal, beside the organization's other settings.

Bounded twice

By the list you set, and by what the person giving the role holds.