GEvonia GateDocs
API referenceDashboard

Scopes and roles

OAuth scopes

Eight scopes may be requested at authorization time. Anything else is rejected.

ScopeGrants
openidIssues an ID token. Required for OIDC
profileName and image on the user info endpoint
emailEmail address and verification status
offline_accessIssues a refresh token, and adds refresh_token to the client's grant types
project:readRead project metadata
config:readRead configuration
usage:writeRecord usage events
account:readList your linked social accounts for the calling project
account:manageList, link, and unlink your shared social account bindings
billing:manageManage plans, checkout, and entitlements

The consent screen renders a human-readable line for each.

Audiences

The resource parameter names the API that will accept the token. Gate accepts:

  • {GATE_BASE_URL}/api — Gate's own API
  • https://api.shelltime.xyz
  • https://api.rawback.app
  • every entry in GATE_ALLOWED_AUDIENCES, comma separated

Unlike origins, audiences are configurable without a code change.

Token lifetimes and prefixes

TokenLifetimePrefix
Authorization code300 s—
Access token (user)600 sgate_at_ when opaque
Access token (machine to machine)300 sgate_at_ when opaque
ID token600 s—
Refresh token2,592,000 s (30 days)gate_rt_
Client secretNo expirygate_cs_
Service API keyUntil revoked or expiresAtgate_sk_

Signing keys are ES256 and rotate every 30 days, with the previous key honoured for a further 30.

Custom claims

Four namespaced claims, advertised in claims_supported:

Text
https://evonia-gate.annatarhe.com/organization_id
https://evonia-gate.annatarhe.com/project_id
https://evonia-gate.annatarhe.com/environment_id
https://evonia-gate.annatarhe.com/resource

organization_id comes from the client's reference id, project_id and environment_id from its registration metadata, and resource from the request.

Control-plane permissions

The statements Gate defines:

ResourceActions
organizationupdate, delete
membercreate, update, delete
invitationcreate, cancel
teamcreate, update, delete
accreate, read, update, delete
projectcreate, read, update, delete
configcreate, read, reveal, update, delete
credentialread, manage
billingread, manage
usageread, write
auditread

The role matrix

Permissionowneradmindeveloperbillingviewer
organization:update✓✓
organization:delete✓
member:create / update / delete✓✓
invitation:create / cancel✓✓
team:create / update / delete✓✓
ac:read✓✓✓✓✓
ac:create / update / delete✓✓
project:create✓✓✓
project:read✓✓✓✓✓
project:update✓✓✓
project:delete✓✓
config:create✓✓✓
config:read✓✓✓✓✓
config:reveal✓✓
config:update✓✓✓
config:delete✓✓✓
credential:read✓✓✓
credential:manage✓✓
billing:read✓✓✓✓✓
billing:manage✓✓✓
usage:read✓✓✓✓✓
usage:write✓✓✓
audit:read✓✓✓✓✓

Reading the differences:

  • admin is owner minus organization:delete.
  • developer can build but cannot reveal secrets, manage credentials, manage billing, delete projects, or touch organization membership.
  • billing can manage billing and read everything else.
  • viewer is read-only everywhere.

Organizations may define up to 25 additional dynamic roles.

Service account scopes

A service account's key scopes are checked against the same permission strings. * matches everything. Each entry must match ^[a-z*][a-z0-9:*_-]*$, and a key holds between 1 and 30.

Service accounts are additionally bound to one project, and optionally one environment.

Project permissions

A separate system — see RBAC and authorize. You choose the strings; they must match:

Text
^(\*|[a-z][a-z0-9_-]*:[a-z][a-z0-9_-]*)$

Up to 100 per role. Gate stores and compares them but never interprets them.