-
Answers a request that needs a caller and carries no credential at all.
Reads one kind of credential off a request.
A way to sign in, listed at GET /auth/methods for a client to offer.
Whether a caller holds a role — read from a token, a database, anywhere.
Flash security: the authentication chain, the policies security annotations declare, sessions,
and the /auth/logout and /auth/methods routes.
The authenticated caller of the current request: the
Principal a mechanism produced, the
application user it resolves to, and the roles and scopes it holds.
What a handler's or tool's security annotations require, compiled once at boot.
A credential as OpenAPI names and defines it, the WWW-Authenticate challenge an anonymous
API call receives for it, and — for OAuth — the issuer that grants it.
A signed-in principal, kept server-side under the id its cookie carries.
Renews an expired session — with a refresh token, typically.
The resource a role is checked on: the values
RolesAllowed.on() names, read from path
and query parameters on HTTP and from tool arguments on MCP.
The application user a verified principal belongs to — typically found, or provisioned, by issuer and subject.