App tokens
How an installed app acts on its project. A signed-in project member gets a 5 minute session token for an install at POST /v1/apps/session-tokens (the dashboard hands it to the app's UI); the app's backend verifies it with the keys at /v1/apps/jwks.json and exchanges it, or asks for the install's own client_credentials token, at POST /v1/oauth/token (RFC 8693 and RFC 6749, authenticated with the app's client secret). Scopes are the install's consented scopes within the member's current team role, never an Ivora staff role. Every request re-checks the install, so uninstalling revokes tokens at once. Each install has its own request budget (120 a minute by default), and the app's registered UI origins may call /v1 from the browser with its tokens. App tokens are refused on /v1/admin, API-key, member, app-registry and payment-method routes.
3 endpoints
- postGet a session token for an installed app/v1/apps/session-tokensFor the dashboard to hand to an app's UI (getAccessToken).
- getPublic keys that verify app tokens/v1/apps/jwks.jsonThe JSON Web Key Set (ES256) of the keys Ivora signs session and access tokens with.
- postExchange a session token or use client credentials/v1/oauth/tokenFor an app's backend, which authenticates as the app with its client id (the app's id) and client secret, by HTTP Basic or in the body.