Laboratory › Developers › Authentication

Authentication

Every endpoint is public and read-only. An authentication system would create a credential store, a breach surface and a privileged code path, guarding nothing.

The rule that will not change

The contract it will honour

Written down now, while nothing depends on it, so it cannot be invented differently later under pressure to ship.

• Bearer credentials in the Authorization header. Never in a query string, because URLs are logged, cached, shared and put in referrers.
• Scopes are explicit and least-privilege. Ambiguous or absent scope fails closed.
• Separate credentials per environment; a credential valid in one is invalid in the other.
• Authentication grants access, never scientific authority. No credential, tier or payment can change a claim's qualification, replication or publication status.

Why not build it now anyway

An authentication system with nothing behind it is not a head start. It is a credential store to breach, a privileged code path to audit, a session lifecycle to get wrong, and a login page that teaches users this site asks for credentials — which is exactly the habit a scientific archive should not cultivate.

See the deferred ledger for the same reasoning applied across the rest of the architecture.