16 lines
985 B
Markdown
16 lines
985 B
Markdown
# Service Authentication
|
|
|
|
Service clients are separate from Node Agent identities and operator administration. Creation
|
|
returns an `mfsvc_…` bearer secret once. Only SHA-256, a non-secret prefix, timestamps, expiry,
|
|
status, rate/concurrency policy and explicit capability scopes are stored. Secrets are absent from
|
|
audit events and ordinary logs.
|
|
|
|
Human credentials use the separate `mfop_` namespace and deployment-owned identity registry described
|
|
in [Operator access](../operations/OPERATOR_ACCESS.md). They never authenticate capability or node
|
|
requests; machine credentials never become human principals or Console sessions.
|
|
|
|
Gateway authentication rejects missing, malformed, unknown, revoked or expired credentials,
|
|
disabled clients and missing capability scope. Each client has a sliding one-minute request limit
|
|
and a concurrent-request limit. Credential creation and revocation are audited. The frontend keeps
|
|
the one-time value in memory only and never reloads plaintext.
|