Auth Service
The Auth Service issues and validates credentials for every request that flows through the API Gateway and our internal services. It is the single source of truth for identity, sessions, and access policy.
Purpose
Auth centralizes authentication so product teams never reimplement login, token refresh, or permission checks β one integration, consistent behavior everywhere.
Core responsibilities
- Token issuance: mints short-lived access tokens and rotating refresh tokens.
- Session management: tracks active sessions and supports remote revocation from the Operations console.
- Access policy: evaluates role- and attribute-based rules before a request reaches a service.
- Audit trail: streams every grant and denial to Observability.