Skip to main content

Auth and Identity

OPS Platform v2 supports Supabase/OIDC-oriented auth, bearer tokens, cookies, and API keys.

Backend auth inputs​

Implemented in:

  • backend/core-api/app/core/auth.py
  • backend/core-api/app/core/api_key_auth.py
  • backend/core-api/app/core/rbac_deps.py
  • backend/core-api/app/core/rbac_config.py

Accepted auth forms:

  • Authorization: Bearer <jwt>
  • access_token cookie
  • X-API-Key

OpenAPI security schemes are registered in backend/core-api/app/main.py:

  • BearerAuth
  • ApiKeyAuth

Provider modes​

AUTH_PROVIDER_MODE supports:

  • supabase_dual
  • supabase_only
  • legacy_custom

Identity mapping convention​

Canonical authenticated user id resolution priority from AGENTS.md:

  1. user_id
  2. user_uuid
  3. sub

Use profile DID mapping for OIDC identity linking where applicable. Be careful with UUID-only DB fields: do not assume every sub is a UUID.

Frontend auth paths​

  • apps/webapp/src/app/auth/login/route.ts
  • apps/webapp/src/app/auth/callback/route.ts
  • apps/webapp/src/app/auth/refresh/route.ts
  • apps/webapp/src/app/auth/logout/route.ts
  • apps/webapp/src/app/auth/supabase/session/route.ts
  • apps/webapp/src/lib/oidc.ts