Authentication & Authorization¶
Adsify uses standard OIDC/OAuth2 for authentication and a hybrid RBAC + scopes model for authorization. The API is stateless — it only validates incoming JWTs.
Token Acquisition¶
Client type |
Flow |
Description |
|---|---|---|
Human users (HMI/Diag) |
Authorization Code + PKCE |
Client app handles login redirect; API validates the JWT |
Machine clients (AI agents) |
Client Credentials |
Agent authenticates directly with IdP using client ID + secret |
Provider Support¶
Adsify is provider-agnostic — any OIDC-compliant IdP works. First-class tested configurations for:
Keycloak (self-hosted, open source)
Microsoft Entra ID (Azure AD)
The RoleClaimType setting accommodates different IdP claim structures. A RoleClaimTransformer normalizes claims regardless of provider.