Authentication

Version: 0.1 · Last Updated: 2026-08-22 · Status: 🔴 DA REVISIONARE

The need. Only the right people get in — and a known person refused must be told apart from a stranger: 401 to the anonymous, 403 to the known.

Who is calling: auth core and methods (OIDC included), API keys, user store, token administration. The house rule everywhere: 401 to the anonymous, 403 to the known.

Interactions: middleware · server-application sections (auth/users/tokens) · sessions.