mirror of
https://github.com/hanzoai/sign.git
synced 2026-10-21 01:21:51 +00:00
zeekay
34194a1495
An audience proves nothing alone: any client IAM authenticates may mint a token for this app's resource. So the bearer is an application's access token whose azp IAM_APP_TEAMS lists, and it acts for exactly the team that list maps it to, as that team's organisation owner. People sign in; the person bearer and the X-Team-Id choice are gone, and so is IAM_ORG. A sign-in's id_token is never a bearer. A webhook carries eSign's identity only to the Hanzo API, minted for it; any other endpoint gets the webhook's own secret and nothing of ours.