Authentication

Naburis provides a centralized identity provider implementing OpenID Connect (OIDC) for all authentication flows.

Authentication Flow

Browser Applications

Single-page applications use the Authorization Code flow with PKCE:

The SPA OIDC configuration is available at each product’s /auth/config endpoint:

curl https://ks.naburis.cloud/auth/config
# {"issuer":"https://auth.naburis.cloud","clientId":"...","projectId":"..."}

Machine-to-Machine

For server-side integration:

• Client Credentials grant — for automated service-to-service communication
• Personal Access Tokens (PATs) — for admin scripts and CI/CD pipelines

JWT Structure

Every access token is a signed JWT (RS256) verified independently by each product via OIDC JWKS discovery. No shared session state exists between services.

Standard Claims

Claim	Description
sub	User ID
iss	Issuer URL
aud	Project ID
exp	Token expiration
urn:zitadel:iam:org:id	Organization (tenant) ID
urn:zitadel:iam:org:project:roles	Project role grants

Naburis Platform Claims

These claims are injected automatically via a pre-access-token webhook and carry your tenant, plan, and entitlement context:

Claim	Type	Description
Customer ID	string	Your customer identifier
Plan	string	Overall subscription plan
Products	string[]	Active product memberships
Product plans	object	Product → plan tier mapping

These claims drive authorization, metering, and rate limiting across all products.

Scope Enforcement

Every authenticated request goes through a two-layer authorization check:

1. JWT Verification — Verifies the token signature via OIDC JWKS
2. Scope Enforcement — Ensures the X-Tenant-ID and X-Workspace-ID headers match the JWT claims

If the tenant ID in the header doesn’t match the org ID in the token, the request is denied.