zeekay
1943f1c093
Multi-tenant commerce and billing: orders, subscriptions, invoices, plans, usage metering and a credit ledger. One Go binary. MIT OR Apache-2.0. Claude-Session: https://claude.ai/code/session_01SAtaDFm8VDiWrhYHNNtxMw
1.4 KiB
Token Flows
App API Key & Customer Token Flow
Organizations support the concept of an app, a container for a set of predefined API Keys for use with organization websites, servers, and other applications. The reason that Apps exist is that each App can be managed and tracked individually. Resetting an App can expire all keys just for that App.
API Keys are used for accessing all data within an particular Organization and for logging in Customers for that organization. Only a subset of endpoints are available to API Keys and Permissions are respected by each endpoint. Logging a customer in involves issuing an Customer Token based on the Customer's login and is exclusively used for accessing a Customer's. Customer tokens do not work on endpoints that API Keys work and vice versa.
Customer Tokens are good for 1 hour. API Keys have no limit.
Organization Reference Token & Access Token Flow
Organizations maintain Reference tokens with the scopes, teams, and permissions for each user with access to the Organization. Reference Tokens are used to generate both the OAuth Access and Refresh Tokens.
Access and Refresh Tokens are generated either by a User supplying their Login and Organizational credentials. Access Tokens can also be generated by supplying a previously generated Refresh Token.
Access Tokens are good for 1 hour. Refresh Tokens are good forever.