[{"data":1,"prerenderedAt":275},["ShallowReactive",2],{"i-lucide:shapes":3,"i-lucide:server":8,"i-lucide:library":10,"i-lucide:list-checks":12,"i-lucide:waypoints":14,"i-lucide:calendar-range":16,"i-lucide:layers":18,"i-lucide:notebook-pen":20,"i-lucide:swords":22,"i-lucide:terminal":24,"i-lucide:list":26,"i-lucide:gauge":28,"i-lucide:webhook":30,"i-lucide:home":32,"i-lucide:layout-grid":34,"i-lucide:tag":36,"i-lucide:newspaper":38,"i-lucide:map":40,"i-lucide:flask-conical":42,"i-lucide:arrow-right":44,"i-lucide:book-open":46,"i-lucide:chevron-right":48,"i-lucide:search":50,"i-lucide:monitor":52,"content:\u002Fdocs\u002Fauthentication":54,"i-lucide:info":273,"i-lucide:git-compare":270,"i-lucide:key-round":270,"i-lucide:bot":270,"i-lucide:fingerprint":270,"i-lucide:blocks":270,"i-lucide:octagon-alert":270,"i-lucide:rocket":270},{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":7},0,24,false,"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M8.3 10a.7.7 0 0 1-.626-1.079L11.4 3a.7.7 0 0 1 1.198-.043L16.3 8.9a.7.7 0 0 1-.572 1.1Z\"\u002F>\u003Crect width=\"7\" height=\"7\" x=\"3\" y=\"14\" rx=\"1\"\u002F>\u003Ccircle cx=\"17.5\" cy=\"17.5\" r=\"3.5\"\u002F>\u003C\u002Fg>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":9},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Crect width=\"20\" height=\"8\" x=\"2\" y=\"2\" rx=\"2\" ry=\"2\"\u002F>\u003Crect width=\"20\" height=\"8\" x=\"2\" y=\"14\" rx=\"2\" ry=\"2\"\u002F>\u003Cpath d=\"M6 6h.01M6 18h.01\"\u002F>\u003C\u002Fg>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":11},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"m16 6l4 14M12 6v14M8 8v12M4 4v16\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":13},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M13 5h8m-8 7h8m-8 7h8M3 17l2 2l4-4M3 7l2 2l4-4\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":15},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"m10.586 5.414l-5.172 5.172m13.172 2.828l-5.172 5.172M6 12h12\"\u002F>\u003Ccircle cx=\"12\" cy=\"20\" r=\"2\"\u002F>\u003Ccircle cx=\"12\" cy=\"4\" r=\"2\"\u002F>\u003Ccircle cx=\"20\" cy=\"12\" r=\"2\"\u002F>\u003Ccircle cx=\"4\" cy=\"12\" r=\"2\"\u002F>\u003C\u002Fg>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":17},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Crect width=\"18\" height=\"18\" x=\"3\" y=\"3\" rx=\"2\"\u002F>\u003Cpath d=\"M16 2v3M3 9h18M8 2v3m9 8h-6m2 4H7m0-4h.01M17 17h.01\"\u002F>\u003C\u002Fg>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":19},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M12.83 2.18a2 2 0 0 0-1.66 0L2.6 6.08a1 1 0 0 0 0 1.83l8.58 3.91a2 2 0 0 0 1.66 0l8.58-3.9a1 1 0 0 0 0-1.83z\"\u002F>\u003Cpath d=\"M2 12a1 1 0 0 0 .58.91l8.6 3.91a2 2 0 0 0 1.65 0l8.58-3.9A1 1 0 0 0 22 12\"\u002F>\u003Cpath d=\"M2 17a1 1 0 0 0 .58.91l8.6 3.91a2 2 0 0 0 1.65 0l8.58-3.9A1 1 0 0 0 22 17\"\u002F>\u003C\u002Fg>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":21},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M13.4 2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2v-7.4M2 6h4m-4 4h4m-4 4h4m-4 4h4\"\u002F>\u003Cpath d=\"M21.378 5.626a1 1 0 1 0-3.004-3.004l-5.01 5.012a2 2 0 0 0-.506.854l-.837 2.87a.5.5 0 0 0 .62.62l2.87-.837a2 2 0 0 0 .854-.506z\"\u002F>\u003C\u002Fg>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":23},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M14.5 17.5L3 6V3h3l11.5 11.5M13 19l6-6m-3 3l4 4m-1 1l2-2M14.5 6.5L18 3h3v3l-3.5 3.5M5 14l4 4m-2-1l-3 3m-1-1l2 2\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":25},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M12 19h8M4 17l6-6l-6-6\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":27},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M3 5h.01M3 12h.01M3 19h.01M8 5h13M8 12h13M8 19h13\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":29},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"m12 14l4-4M3.34 19a10 10 0 1 1 17.32 0\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":31},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M18 16.98h-5.99c-1.1 0-1.95.94-2.48 1.9A4 4 0 0 1 2 17c.01-.7.2-1.4.57-2\"\u002F>\u003Cpath d=\"m6 17l3.13-5.78c.53-.97.1-2.18-.5-3.1a4 4 0 1 1 6.89-4.06\"\u002F>\u003Cpath d=\"m12 6l3.13 5.73C15.66 12.7 16.9 13 18 13a4 4 0 0 1 0 8\"\u002F>\u003C\u002Fg>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":33},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M15 21v-8a1 1 0 0 0-1-1h-4a1 1 0 0 0-1 1v8\"\u002F>\u003Cpath d=\"M3 10a2 2 0 0 1 .709-1.528l7-6a2 2 0 0 1 2.582 0l7 6A2 2 0 0 1 21 10v9a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z\"\u002F>\u003C\u002Fg>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":35},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Crect width=\"7\" height=\"7\" x=\"3\" y=\"3\" rx=\"1\"\u002F>\u003Crect width=\"7\" height=\"7\" x=\"14\" y=\"3\" rx=\"1\"\u002F>\u003Crect width=\"7\" height=\"7\" x=\"14\" y=\"14\" rx=\"1\"\u002F>\u003Crect width=\"7\" height=\"7\" x=\"3\" y=\"14\" rx=\"1\"\u002F>\u003C\u002Fg>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":37},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M12.586 2.586A2 2 0 0 0 11.172 2H4a2 2 0 0 0-2 2v7.172a2 2 0 0 0 .586 1.414l8.704 8.704a2.426 2.426 0 0 0 3.42 0l6.58-6.58a2.426 2.426 0 0 0 0-3.42z\"\u002F>\u003Ccircle cx=\"7.5\" cy=\"7.5\" r=\".5\" fill=\"currentColor\"\u002F>\u003C\u002Fg>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":39},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M15 18h-5m8-4h-8m-6 8h16a2 2 0 0 0 2-2V4a2 2 0 0 0-2-2H8a2 2 0 0 0-2 2v16a2 2 0 0 1-4 0v-9a2 2 0 0 1 2-2h2\"\u002F>\u003Crect width=\"8\" height=\"4\" x=\"10\" y=\"6\" rx=\"1\"\u002F>\u003C\u002Fg>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":41},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M14.106 5.553a2 2 0 0 0 1.788 0l3.659-1.83A1 1 0 0 1 21 4.619v12.764a1 1 0 0 1-.553.894l-4.553 2.277a2 2 0 0 1-1.788 0l-4.212-2.106a2 2 0 0 0-1.788 0l-3.659 1.83A1 1 0 0 1 3 19.381V6.618a1 1 0 0 1 .553-.894l4.553-2.277a2 2 0 0 1 1.788 0zm.894.211v15M9 3.236v15\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":43},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M14 2v6a2 2 0 0 0 .245.96l5.51 10.08A2 2 0 0 1 18 22H6a2 2 0 0 1-1.755-2.96l5.51-10.08A2 2 0 0 0 10 8V2M6.453 15h11.094M8.5 2h7\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":45},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M5 12h14m-7-7l7 7l-7 7\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":47},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M12 5v16m8.001-2A2 2 0 0 0 22 17V5a2 2 0 0 0-1.999-2L16 3.002A5 5 0 0 0 12 5a5 5 0 0 0-4-2H4a2 2 0 0 0-2 2v12a2 2 0 0 0 1.999 2H8a5 5 0 0 1 4 2a5 5 0 0 1 4-2z\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":49},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"m9 18l6-6l-6-6\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":51},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"m21 21l-4.34-4.34\"\u002F>\u003Ccircle cx=\"11\" cy=\"11\" r=\"8\"\u002F>\u003C\u002Fg>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":53},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Crect width=\"20\" height=\"14\" x=\"2\" y=\"3\" rx=\"2\"\u002F>\u003Cpath d=\"M8 21h8m-4-4v4\"\u002F>\u003C\u002Fg>",{"id":55,"title":56,"body":57,"description":263,"extension":264,"eyebrow":265,"hostedOnly":6,"meta":266,"navigation":267,"path":268,"seo":269,"short":270,"stem":271,"__hash__":272},"docs\u002Fdocs\u002Fauthentication.md","Authentication",{"type":58,"value":59,"toc":255},"minimark",[60,78,88,102,107,114,120,182,185,189,196,200,203,209,212,216,219,223,230,234,251],[61,62,63,64,68,69,73,74,77],"p",{},"Every call to the Chronicler API carries a ",[65,66,67],"strong",{},"bearer token"," in the ",[70,71,72],"code",{},"Authorization"," header. The server verifies it in middleware and puts the caller's identity, the ",[65,75,76],{},"principal",", on the request. A request without a valid token is rejected before it reaches any handler.",[79,80,85],"pre",{"className":81,"code":83,"language":84},[82],"language-text","Authorization: Bearer \u003Caccess-token>\n","text",[70,86,83],{"__ignoreMap":87},"",[89,90,93],"callout",{"title":91,"tone":92},"Two ways to hold a token","note",[61,94,95,96,101],{},"A person's browser session and a machine integration authenticate the same way at the header, but they get their tokens differently. This page covers user tokens. For a non-human integration, use a ",[97,98,100],"a",{"href":99},"\u002Fdocs\u002Fservice-accounts-and-tokens","service account and an API token",".",[103,104,106],"h2",{"id":105},"get-a-token-by-logging-in","Get a token by logging in",[61,108,109,110,113],{},"A password login returns a ",[65,111,112],{},"token pair",": a short-lived access token and a longer-lived refresh token. Send the access token on API calls. Keep the refresh token to get a new access token when the old one expires.",[79,115,118],{"className":116,"code":117,"language":84},[82],"POST \u002Fapi\u002Fv1\u002Fauth\u002Flogin\nContent-Type: application\u002Fjson\n\n{ \"email\": \"you@example.com\", \"password\": \"...\" }\n",[70,119,117],{"__ignoreMap":87},[79,121,125],{"className":122,"code":123,"language":124,"meta":87,"style":87},"language-json shiki shiki-themes github-light github-dark","{\n  \"accessToken\": \"...\",\n  \"refreshToken\": \"...\",\n  \"expiresIn\": 900\n}\n","json",[70,126,127,136,153,165,176],{"__ignoreMap":87},[128,129,132],"span",{"class":130,"line":131},"line",1,[128,133,135],{"class":134},"sVt8B","{\n",[128,137,139,143,146,150],{"class":130,"line":138},2,[128,140,142],{"class":141},"sj4cs","  \"accessToken\"",[128,144,145],{"class":134},": ",[128,147,149],{"class":148},"sZZnC","\"...\"",[128,151,152],{"class":134},",\n",[128,154,156,159,161,163],{"class":130,"line":155},3,[128,157,158],{"class":141},"  \"refreshToken\"",[128,160,145],{"class":134},[128,162,149],{"class":148},[128,164,152],{"class":134},[128,166,168,171,173],{"class":130,"line":167},4,[128,169,170],{"class":141},"  \"expiresIn\"",[128,172,145],{"class":134},[128,174,175],{"class":141},"900\n",[128,177,179],{"class":130,"line":178},5,[128,180,181],{"class":134},"}\n",[61,183,184],{},"The tokens come back in the response body, not in a cookie. Store them where your client can read them and attach the access token to each request.",[103,186,188],{"id":187},"sign-in-with-a-provider","Sign in with a provider",[61,190,191,192,195],{},"For provider login, such as Google, the flow is an OAuth Authorization Code exchange with PKCE. Because the provider returns the user through a browser navigation and Chronicler issues tokens in a body rather than a cookie, the callback hands your app a ",[65,193,194],{},"single-use handoff code",". Your app trades that code for the real token pair. The token never travels in the callback URL.",[103,197,199],{"id":198},"refresh-before-you-expire","Refresh before you expire",[61,201,202],{},"An access token is deliberately short-lived. When it is close to expiry, exchange the refresh token for a new pair:",[79,204,207],{"className":205,"code":206,"language":84},[82],"POST \u002Fapi\u002Fv1\u002Fauth\u002Frefresh\nContent-Type: application\u002Fjson\n\n{ \"refreshToken\": \"...\" }\n",[70,208,206],{"__ignoreMap":87},[61,210,211],{},"Each refresh issues a new pair and retires the old refresh token. If a refresh token is ever replayed, Chronicler detects it and rejects it, which is a signal the token was leaked.",[103,213,215],{"id":214},"sessions-are-revocable","Sessions are revocable",[61,217,218],{},"A session can be ended at once, not just left to expire. A user can list their active sessions and revoke any of them, and a revoked session's tokens stop working immediately through a per-family liveness check. This is what makes \"sign out everywhere\" real rather than cosmetic.",[103,220,222],{"id":221},"step-up-for-dangerous-actions","Step-up for dangerous actions",[61,224,225,226,229],{},"Some actions demand fresh proof that you are still at the keyboard, not just that you logged in earlier. Changing multi-factor settings, changing billing, and starting an impersonation session all sit behind ",[65,227,228],{},"step-up authorisation",": a recent re-proof of identity, recorded server-side. If a call needs step-up and you have not re-proved recently, the API tells you, and you re-authenticate before retrying.",[103,231,233],{"id":232},"where-to-go-next","Where to go next",[235,236,237,244],"ul",{},[238,239,240,241,101],"li",{},"Authenticate a machine with ",[97,242,243],{"href":99},"Service accounts & tokens",[238,245,246,247,101],{},"See how the auth surface is designed in ",[97,248,250],{"href":249},"\u002Finternal\u002Farchitecture\u002Fauthentication","Authentication & identity",[252,253,254],"style",{},"html pre.shiki code .sVt8B, html code.shiki .sVt8B{--shiki-default:#24292E;--shiki-dark:#E1E4E8}html pre.shiki code .sj4cs, html code.shiki .sj4cs{--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .sZZnC, html code.shiki .sZZnC{--shiki-default:#032F62;--shiki-dark:#9ECBFF}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":87,"searchDepth":138,"depth":138,"links":256},[257,258,259,260,261,262],{"id":105,"depth":138,"text":106},{"id":187,"depth":138,"text":188},{"id":198,"depth":138,"text":199},{"id":214,"depth":138,"text":215},{"id":221,"depth":138,"text":222},{"id":232,"depth":138,"text":233},"How to authenticate a request to the Chronicler API. Send a bearer token on every call, get one by logging in or from a provider, and refresh it before it expires.","md","Developers",{},{"title":56},"\u002Fdocs\u002Fauthentication",{"title":56,"description":263},null,"docs\u002Fauthentication","8buXnAEgXJzaX4cQJ5OX2MzZB2Kl97x-FW-NnVMyJHk",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":274},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Ccircle cx=\"12\" cy=\"12\" r=\"10\"\u002F>\u003Cpath d=\"M12 16v-4m0-4h.01\"\u002F>\u003C\u002Fg>",1788784058100]