API Concepts
Core concepts and architectural patterns of the AuthOS API including JWT authentication, dual flows, and BYOO integration.
API Concepts
This section covers the core concepts and architectural patterns of the AuthOS API.
Available Concepts
- Architecture - System-wide overview and multi-tenant design
- Authentication Flows - JWT structure, dual authentication flows, and Bring Your Own OAuth (BYOO)
- Token Validation - Backend token validation using the JWKS endpoint
- Access Control - RBAC/ReBAC permission models and policy evaluation
- User Journeys - End-to-end flows for onboarding, authentication, and management
- Rate Limiting - Rate limit policies, handling 429 errors, and resilient client patterns
- Background Jobs - System maintenance tasks, token refresh, webhook delivery, and database optimization
Pages
Architecture Overview
High-level overview of the AuthOS system architecture, core components, and data model.
Access Control
Understanding ReBAC permission system and authorization
Authentication Flows
Detailed guide to AuthOS authentication flows including Authorization Code, Device Flow, and Passwordless, with sequence diagrams.
User & System Journeys
Detailed end-to-end walkthroughs of primary user and system interactions within AuthOS.
JWT Structure & Validation
Comprehensive guide to AuthOS JSON Web Tokens, including structure, signing, and backend validation code examples.
Rate Limiting
Rate limiting policies, limits per endpoint group, handling 429 errors, and best practices for building resilient API clients.
Background Jobs
Background jobs and system maintenance tasks including token refresh, webhook delivery, state cleanup, and database optimization.