Long-lived credentialCustom Access Token
01
cat_********4K9CATS overview / reviewed
Scoped access,
without shared passwords.
Give customers a safe way to connect scripts, automations, and small apps to the APIs your product owns.
Credential path3 stages
Exchange through AAA
Short-lived credentialAccess token
02
scope: issues:readYour app's APIScope checked
Permission modelCustom scopes
Customer useScripts & automations
API boundaryYour app services
The division of responsibility
A small contract with clear owners.
CATS manages the credential lifecycle. Your app still owns permission design and request authorization.
APP
Your responsibility
Appfire app
- Define product-specific scopes
- Issue and manage CATs with the CATS SDK
- Validate tokens and enforce scopes on APIs
@appfire-platform/cats-sdk
AAA
Platform responsibility
CATS + Authentication
- Store each CAT's lifecycle
- Exchange a CAT for a short-lived token
- Carry the app-defined scopes forward
issues:readworkflow:run
Request flow
Follow one authorized request.
Three actors, three responsibilities, one bounded path into your APIs.
APPFIRE APPSTEP 1 OF 3
conceptual-flow.txt
Scope lab
See least privilege in action.
Authorization decision
Request allowed
The short-lived token carries the required issues:read scope.
Required
issues:readActorPrimary actionOwns
Appfire appCreates and manages CATs
Scopes + enforcementCATS + AAAStores lifecycle and performs exchange
Token lifecycleCustomerExchanges CAT, then calls app APIs
Client integrationImplementation review
Are the boundaries ready?
Use this checklist to turn the overview into an actionable integration plan.
0%0 of 6 ready
01
Foundation
Define access
02
Token journey
Operate the credential
03
API boundary