Identity & authentication
The Identity module manages users, roles, permissions, and sessions. The Identity side includes JWT issuance, refresh, and password management, all configured through Platform Settings → Security.
Accounts
- Owner is created during customer onboarding and receives a temporary password.
- Members/operators can be invited by owners and assigned roles.
- Credentials are never stored in plaintext; passwords are hashed before persistence.
Roles & authorization
Authorization is role-based. The platform ships with these roles:
| Role | Scope |
|---|---|
SuperAdmin |
Full platform access, including Platform Settings |
PlatformAdmin |
Manage customers and platform operations |
Operations |
Operations/monitoring dashboard, backups |
Developer |
API access, webhook/debug tooling |
Support |
Customer-facing triage and read access |
Customer |
Default role for product customers |
Every mutating action is captured by the Audit module, so authorization decisions are traceable.
JWT session flow
- User signs in via
/login→ tokens issued. - Access token authorizes API calls (short-lived:
JwtAccessTokenMinutes). - Refresh token swaps for a new access token when expired (lifetime:
JwtRefreshTokenDays). - On logout, both tokens are revoked server-side.
Login ──▶ Access (15m) Access (15m)
+ Refresh (7d) ──▶ + new Refresh (7d) ──▶ ...The exact lifetimes come from Security → JwtAccessTokenMinutes / JwtRefreshTokenDays.
Security hardening
| Setting (Security) | Purpose |
|---|---|
MaxFailedLoginAttempts |
Lockout after N failures |
LockoutDurationMinutes |
Lockout cooling-off period |
JwtAccessTokenMinutes |
Access token expiry |
JwtRefreshTokenDays |
Refresh token expiry |
Password lifecycle
- First sign-in requires changing the temporary password.
- Passwords are hashed (bcrypt-style) before storage.
- Reset flows are delivered through the Notification module.
Related
- Customer onboarding — account creation
- Platform settings reference — Security settings
- Security & compliance — transport, audit, secrets