703 B
703 B
Service Authentication
Service clients are separate from Node Agent identities and operator administration. Creation
returns an mfsvc_… bearer secret once. Only SHA-256, a non-secret prefix, timestamps, expiry,
status, rate/concurrency policy and explicit capability scopes are stored. Secrets are absent from
audit events and ordinary logs.
Gateway authentication rejects missing, malformed, unknown, revoked or expired credentials, disabled clients and missing capability scope. Each client has a sliding one-minute request limit and a concurrent-request limit. Credential creation and revocation are audited. The frontend keeps the one-time value in memory only and never reloads plaintext.