API JWT Authentication

Opt-in: active once Authentication:Authority is set

API JWT Authentication Opt-in: active once Authentication:Authority is set OIDC discovery issuer + signing keys client_credentials access_token POST /Execution/start Authorization: Bearer; aud = Audience start instance 200 / 401 if missing or invalid POST /UserTasks/{id}/claim groups = token groups claim claim with token groups body userGroups ignored 200 / 409 if not authorized Startup Token Workflow call User-task claim Client · script / service · Sequence participant Client script / service OIDC IdP · Authority · Sequence participant OIDC IdP Authority fleans-api · JWT bearer · Sequence participant fleans-api JWT bearer Engine · workflow grains · Sequence participant Engine workflow grains Legend request return security async trace

Sequence diagram • Built with Archify • Create yours ↗ • Hover to trace • R route • Click to focus • +/− zoom • M radar • T theme • E export