985 B
Service Authentication
Service clients are separate from Node Agent identities and operator administration. Creation
returns an mfsvc_… bearer secret once. Only SHA-256, a non-secret prefix, timestamps, expiry,
status, rate/concurrency policy and explicit capability scopes are stored. Secrets are absent from
audit events and ordinary logs.
Human credentials use the separate mfop_ namespace and deployment-owned identity registry described
in Operator access. They never authenticate capability or node
requests; machine credentials never become human principals or Console sessions.
Gateway authentication rejects missing, malformed, unknown, revoked or expired credentials, disabled clients and missing capability scope. Each client has a sliding one-minute request limit and a concurrent-request limit. Credential creation and revocation are audited. The frontend keeps the one-time value in memory only and never reloads plaintext.