One person · three focused services

Your data moves.
Your trust doesn’t.

You decide. GajuPassport asks. GajuAuth proves and permits. GajuRegistry returns only what you approved. Four clear roles create one secure experience.

Clear boundaries

No service does everything.

That separation is the security model. Private keys stay with their owner, personal data stays with the registry, and the client receives only a scoped result.

00

The resource owner makes the decision

You control the private key and approve or deny every request.

01

Passport never sees your private key

GajuAuth verifies your cryptographic proof.

Open Passport 02

Auth never stores your profile

It manages identity, consent, clients, and tokens.

Open Auth 03

Registry never trusts the client alone

Every request must carry a valid, correctly scoped token.

Open Registry

OAuth2, in plain language

One journey. Seven small hand-offs.

  1. 1

    You → Passport

    Choose “Sign in”

    The client begins an authorisation request for the profile access it needs.

  2. 2

    Passport → Auth

    Continue to GajuAuth

    Your browser moves to GajuAuth, where you prove control of your private key.

  3. 3

    You ↔ Auth

    Verify & consent

    GajuAuth confirms your identity and shows exactly what Passport requested.

  4. 4

    Auth → Passport

    Return a code

    A one-time authorisation code returns through the browser—never your private key.

  5. 5

    Passport → Auth

    Exchange the code

    Passport sends the one-time code to GajuAuth and receives a scoped access token.

  6. 6

    Passport → Registry

    Present the token

    Passport calls the protected Registry API with the access token issued by GajuAuth.

  7. 7

    Registry → Passport

    Share the approved data

    Registry validates issuer, expiry, audience, and scope before responding.

Inside the access token

A compact set of verifiable claims.

GajuAuth signs these claims together. GajuRegistry verifies the signature first, then uses each value to decide whether this particular request is allowed.

This is a simplified illustration, not a usable token or a complete encoded payload.
Signed by GajuAuth
issIssuer
GajuAuthWas it created by the authority Registry trusts?
subSubject
Resource owner IDWhose delegated access does this token represent?
audAudience
GajuRegistryWas the token intended for this resource server?
scopePermissions
Approved operationsDoes the grant permit this endpoint and action?
iatIssued at
Creation timeWhen did the token’s authority begin?
expExpires at
End timeIs the token still inside its permitted lifetime?
The digital signature protects all claims from undetected changes.

Plain-language glossary

Words with precise jobs.

OAuth2 and public-key cryptography work because each artifact has a narrow meaning.

Scope
A named permission limiting what the client may do.
Access token
A signed, temporary statement of delegated authority.
Authorisation code
A short-lived, single-use value exchanged for a token.
Audience
The resource server for which a token is intended.
Issuer
The authority that created and signed the token.
Public key
Shareable material used to verify a digital signature.
Private key
Secret material retained by its owner and used to sign.
Consent
The resource owner's explicit decision about requested access.

The promise

Consent is a boundary, not a checkbox.

The token is a temporary, cryptographically signed statement saying who may access what. It can expire or be revoked without exposing your private key or copying your whole identity.

Scoped access

Authority has a lifetime

A token ends in one of two ways.

Expiry is the planned end of access. Revocation is an earlier decision to stop accepting the grant.

01

Issued

GajuAuth signs a scoped token with a fixed expiry.

02

Active

Registry accepts valid requests within scope and lifetime.

03

Expired

The planned lifetime ends and Registry rejects further use.

Early stop

Revoked

The grant is withdrawn before expiry. Registry must no longer accept authority derived from it.