Service identity and admin embedding
Use the current server and administration protocols with explicit audience and permission boundaries.
The service’s own identity
server-sdk signs identities bound to serviceKey using that service’s derived secret and verifies them through platform introspection. getServiceToken takes a target audience, not another issuer. Services receive their own secret, never the platform master.
import { OptimusServerSdk } from '@mosaic-base/server-sdk';
export function createServiceIdentity(apiBaseUrl: string, serviceKey: string,
serviceIdentitySecret: string) {
return new OptimusServerSdk({
baseUrl: apiBaseUrl,
serviceKey,
serviceIdentitySecret, // server-only, this service's derived secret
cacheTtlMs: 0,
});
}
// A service must never receive the platform master secret.Delegated management pages
Management pages receive a 120-second service-scoped identity through the host handshake. Their backend still authorizes each operation. Failed initialization or renewal must stop protected actions; context subscriptions synchronize theme and language.
import { init, onContextChange, requestToken } from '@mosaic-base/admin-embed';
export async function connectAdministration() {
const context = await init({ baseOrigin: new URL(document.baseURI).origin });
const unsubscribe = onContextChange(({ locale, theme }) => {
document.documentElement.lang = locale;
document.documentElement.dataset.theme = theme;
});
return { context, unsubscribe, refreshIdentity: requestToken };
}
// Keep the delegated token in memory. Backend still checks every operation.Planes and caching
Public page/API, administration and internal calls use their matching Gateway planes. Applications verify signed context rather than client-supplied headers. Introspection cache cannot outlive identity; use cacheTtlMs:0 when disablement or revocation must be checked immediately.