Gaju ecosystem Open GajuRegistry
Resource server

GajuRegistry

I protect the data.

I am the authoritative home of the registry profile. I answer API requests only after the caller presents a token whose issuer, audience, expiry, and scope all pass validation.

My point of view

Resource owner GajuAuth GajuRegistry GajuPassport

Administrative access

Management login is for administrators only.

A person must have a GajuRegistry administrator account to sign in to its management interface. OAuth2 clients access protected registry resources with scoped GajuAuth tokens instead of using the administrative login.

Inside every protected request

A token passes five gates.

GajuRegistry does not accept a token merely because Passport presents it. Each request earns access by passing every independent validation.

Incoming

Access token

  1. 01SignatureVerified with GajuAuth’s public key
  2. 02IssuerCreated by the expected authority
  3. 03AudienceIntended for GajuRegistry
  4. 04LifetimeNot expired or used too early
  5. 05ScopePermits this exact operation

Approved

Scoped resource

If any gate fails, processing stops and the protected resource is not returned.

My part of the conversation

What passes through my boundary.

I receive

  • An API request from GajuPassport
  • A bearer access token issued by GajuAuth
  • A request for specific protected profile fields

I am responsible for

  • Verify the token signature against GajuAuth's public keys
  • Check issuer, audience, expiry, and permitted scopes
  • Match each requested operation to its required permission
  • Return only the resource the token is allowed to access

I send

  • The approved subset of the registry profile
  • A clear OAuth error when the token is invalid or insufficient
  • No private key material and no broader dataset than the scope allows

My lifecycle

What I do, in order.

Each hand-off has a narrow purpose. I complete my checks before authority or protected information moves to the next participant.

  1. 1

    Accept the request

    Receive a protected API call and extract the bearer token without treating the client as inherently trusted.

  2. 2

    Verify the token

    Validate its signature with GajuAuth's public key and reject unknown algorithms or signing keys.

  3. 3

    Enforce the grant

    Check issuer, audience, expiry, subject, and scopes against the requested registry operation.

  4. 4

    Shape the response

    Return only the authorised fields and avoid leaking protected details through errors.

Objects I handle

The artifacts have boundaries too.

Each item carries a particular meaning. None should be treated as unlimited proof, permission, or identity.

Bearer access token
The signed proof of delegated authority presented with the API request.
Token claims
Issuer, subject, audience, expiry, and scopes used to make the authorisation decision.
Registry resource
The protected profile representation returned only after every applicable check succeeds.
OAuth error
A standards-aligned rejection that distinguishes invalid authority from insufficient scope without exposing data.

Security outcomes

What my checks guarantee.

  • Every protected request is independently authorised
  • A token for another audience is rejected
  • Expired or revoked authority cannot read data
  • Responses are limited to the approved operation and fields

Where I stop

A deliberate boundary.

I do not verify the resource owner's identity proof, and I never trust GajuPassport without a valid GajuAuth token.