Authentication and access

Authentication identifies an HTTP caller. Tool and domain authorization decide which action that caller or session may perform. Configure both boundaries.

Protect deployed servers

Use an authentication target with cayu serve, or ServerConfig.protected(auth) when embedding the server. The built-in environment target reads CAYU_OPERATOR_USERNAME and CAYU_OPERATOR_PASSWORD once at target loading and fails on missing or blank values. Use deployed TLS and secret configuration.

For OIDC bearer verification, install cayu[oidc] and configure issuer, audience and required scopes on OidcBearerAuth. It verifies tokens callers already possess; it does not provide a browser sign-in flow.

A custom dependency accepts the request and returns AuthContext or a compatible mapping, or rejects with an HTTP authentication error. Inspect the server API for exact types and defaults.

Define the application’s data boundary

An AuthContext.tenant value is actor provenance. It does not automatically filter every store query or establish multi-tenant isolation. Implement and verify the intended data boundary through deployment/store separation and application authorization.

Test unauthenticated requests, insufficient authority and a caller attempting another session’s operation. CORS controls browser access patterns; it does not substitute for authentication or authorization. Use approvals for exact human-authorized tool actions and authority for effect policy.