Tokens · the wire format
Ed25519 · single-use · TTL-bounded.
An Authority Token is the wire format that authorizes execution. It is a JWS — header, payload, signature — that the connector verifies against the tenant’s public key. Click any segment below to inspect its claims.
Authority Token · EdDSA · Ed25519 · issued — LOCALtyp: JWT
..
Header · the JWS algorithm + token type
contents{ "alg": "EdDSA", "typ": "JWT", "kid": "…" }
algEdDSA · Ed25519 (pure EdDSA), per-tenant key
typJWT · authority-scoped, single-use
kidminting…
Live · single-use · 5 min ttl
02 · Properties
Ed25519
tenant-scoped
single-use
replay refused at connector
10 min
default TTL · configurable
kid-pinned
tenant public-key verify
03 · What the connector checks
Tenant public key
Ed25519 (EdDSA) over the header.payload signing input. Verified against the kid-pinned tenant public key; a per-tenant /.well-known/jwks.json route is live.
Not past exp
10-minute default. The connector refuses anything past expiry. No grace window.
Matches declared action
The intent_hash claim binds the token to the specific action it was issued for.
Not in revoke list
Tokens can be revoked mid-TTL. Connectors check the revocation registry as part of verification.