GajuAuth
I establish trust.
I verify the resource owner's cryptographic proof, ask for informed consent, and issue signed tokens that let the other services cooperate without sharing private keys.
My point of view
Administrative access
Management login is for administrators only.
A person must have a GajuAuth administrator account to sign in to its management interface. Resource owners do not use that administrative login to complete the public-key OAuth2 flow.
My part of the conversation
What passes through my boundary.
I receive
- An authorisation request from GajuPassport
- The client identity, redirect URI, and requested scopes
- The resource owner's public-key proof and consent decision
I am responsible for
- Authenticate the resource owner on my own trusted origin
- Verify that the client and redirect URI are registered
- Make requested access visible before consent
- Issue short-lived authorisation codes and signed access tokens
I send
- A one-time authorisation code back through the browser
- A scoped access token to the authenticated client
- Signed claims GajuRegistry can independently verify
My lifecycle
What I do, in order.
Each hand-off has a narrow purpose. I complete my checks before authority or protected information moves to the next participant.
-
1
Validate the request
Confirm the client, redirect URI, response type, state, and requested scopes before involving the resource owner.
-
2
Verify key control
Challenge the resource owner and verify the returned signature against their registered public key.
-
3
Capture consent
Present the requesting client and scopes so approval is explicit, informed, and attributable.
-
4
Issue authority
Bind the approved subject, client, audience, scopes, and lifetime into signed OAuth2 artifacts.
Objects I handle
The artifacts have boundaries too.
Each item carries a particular meaning. None should be treated as unlimited proof, permission, or identity.
- Authorisation request
- The client's redirect-based request containing its identity, callback, state, and scopes.
- Authorisation code
- A short-lived, single-use value that keeps access tokens out of the browser redirect.
- Access token
- A signed, time-limited statement that GajuRegistry can validate without asking the client to prove the grant again.
- Public keys
- Published verification material that lets trusted resource servers verify token signatures.
Security outcomes
What my checks guarantee.
- Private keys are never collected or redistributed
- Codes are short-lived and single-use
- Tokens are audience-bound and scope-limited
- Consent can be denied or later revoked
Where I stop
A deliberate boundary.
I do not store the registry profile, and the resource owner's private key never needs to reach GajuPassport.