Identity

A single authority for identity and access across every module. Passwords are hashed with Node’s scrypt; sessions are stateless HMAC tokens with token-version revocation on password change; API keys authenticate machines. Every query is scoped to the caller’s organization, and a resource in another tenant returns 404, never 403. POST /api/tokens/verify is the contract other services use to check a caller’s identity.

Responsibilities

• Organizations (tenants), users, roles and a fine-grained permission catalog
• scrypt password hashing with constant-time unknown-account handling
• Stateless HMAC session tokens, revoked on password change
• Machine-to-machine API keys (scrypt-hashed, shown once)
• OAuth endpoints stubbed as the documented seam; multi-tenant isolation

API surface

• POST /api/login · POST /api/logout
• GET /api/me · POST /api/tokens/verify
• GET/POST /api/users · POST /api/users/:id/password
• GET/POST /api/roles · GET /api/permissions
• GET/POST /api/api-keys · DELETE /api/api-keys/:id

CONSUMED BY Every module delegates authentication and authorization here. A Platform Service never depends on a Business Module.