Core concepts

Tenant and issuer

A tenant is the isolation boundary for authentication data. Its issuer is the exact HTTPS origin used in token claims and protocol metadata. Local loopback development is the only supported HTTP exception.

Managed tenants receive an opaque subdomain generated by Identity. An operator may configure a custom issuer as a separate post-creation step after DNS and ingress are ready. Changing an issuer that already owns identities or OAuth state is rejected.

Subject

A subject is a user inside one tenant. The stable identity key consumed by a product is the tuple (issuer, subject). Email can change and may be unverified; it is never a durable binding key.

OAuth client

A client represents one application. Its application type, redirect URIs, authentication method, consent policy, resource audiences, scopes and native-authentication capability are explicit configuration. Public browser/native clients use PKCE and do not receive a client secret.

Resource

A resource identifies an API audience. Access tokens are minted for an explicitly requested and client-authorized resource. A resource server validates its audience before it creates an application identity context.

Control tenant

The control tenant is a separate tenant used to administer Identity itself. Its tokens authorize the /identity/admin API only when the operator also has the required live directory permission. They do not grant access to product APIs.

Federation

Cross-tenant SSO is an explicit directional trust. It does not make tenants interchangeable and it does not allow a resource server to accept another tenant’s token. Account materialization and linking remain explicit operations.