Resource owner
I remain in control.
I am the person whose identity and registry profile are being used. I control my private key, choose which application to trust, and decide which requested permissions to grant.
My point of view
My part of the conversation
What passes through my boundary.
I receive
- A clear sign-in request from GajuPassport
- A cryptographic challenge from GajuAuth
- A consent screen listing the client and requested scopes
I am responsible for
- Keep my private key under my control
- Prove control of that key without disclosing it
- Review which client is asking and what it wants to access
- Approve or deny the request and revoke access when needed
I send
- A public-key proof to GajuAuth
- An explicit consent decision
- No private key material to any service
My lifecycle
What I do, in order.
Each hand-off has a narrow purpose. I complete my checks before authority or protected information moves to the next participant.
-
1
Choose the client
Start from an application I recognise and understand why it wants access to my registry profile.
-
2
Prove key control
Answer GajuAuth's challenge by signing it locally with my private key.
-
3
Review the request
Check the client name, destination, requested scopes, and consequences before deciding.
-
4
Stay in control
Use the granted experience, decline unexpected access, and revoke authority that is no longer needed.
Objects I handle
The artifacts have boundaries too.
Each item carries a particular meaning. None should be treated as unlimited proof, permission, or identity.
- Private key
- My secret signing material. It remains under my control and is never sent as part of the OAuth2 flow.
- Public key
- The verification material that allows GajuAuth to validate my cryptographic proof.
- Signed challenge
- Fresh evidence that I control the corresponding private key without revealing it.
- Consent decision
- My explicit approval or denial of a particular client's requested scopes.
Security outcomes
What my checks guarantee.
- My private key does not leave my control
- I can see which client is requesting access
- I can deny scopes I do not accept
- A grant is limited in purpose and time
Where I stop
A deliberate boundary.
I do not issue tokens or enforce API permissions. I make the trust decision; GajuAuth and GajuRegistry enforce it.