Authentication and Error Model

Access authentication

Common mints short-lived ES256 access JWTs.

SynckHub verifies JWTs via JWKS and must operate with cached keys when Common is unavailable.

Infra-to-control-plane calls use opaque infra bearer tokens minted by Common.

Do not reuse user JWT assumptions for infra service identity.

Common refresh tokens are cookie-based and origin-constrained.

Client behavior must follow Common cookie and allowed-origin rules, especially across multiple origins.

Common and platform contracts use stable error shape:

{ "code": "SOME_CODE", "message": "human-readable message" }

Treat code as the machine contract and message as operator context.