Authentication Service Design

The Authentication Service issues short-lived access tokens and rotating refresh tokens. User sign-in starts with credential validation or OAuth callback exchange. The service stores password hashes with Argon2id and tracks suspicious login attempts by IP and device fingerprint.

JWT access tokens expire after fifteen minutes. Refresh tokens are stored server-side with a hashed token identifier, device metadata, and revocation timestamp. Downstream services validate JWTs using the public key set exposed at /auth/.well-known/jwks.json.

During key rotation, the service publishes auth.keys.rotating and auth.keys.activated events. Checkout and Billing cache JWKS for five minutes and must retry JWKS fetches before rejecting a valid-looking token during rotation windows.

Controls

• Admin endpoints require the admin role claim.
• Service-to-service calls use mTLS and workload identity.
• Suspicious prompts and automation requests are logged to the security queue.