Enforcer v3 docs / Enforcer Auth Model
07Credentials
07
Credentials
Auth model
Three kinds of credential reach the API. Pick by who is calling.
| Credential | Where it comes from | Use it for |
|---|---|---|
| User JWT | Returned by POST /auth/login as token |
User scoped calls. Anything done as the logged in person, reading their own data, switching tenants, accepting an invite. |
| API key | Returned by POST /api-keys, plaintext shown once |
Server and admin calls from your backend. Creating groups, adding members, managing accounts. Keep it server side, never ship it to a browser. |
| Privy access token | From your Privy integration | Pass it directly as the bearer. Enforcer accepts a Privy access token in place of a user JWT. |
All three travel in the same header: Authorization: Bearer <value>. Refresh an expiring user JWT with POST /auth/refresh using its refresh_token.