Security overview

This page lists how a self-hosted instance checks the caller on each path, which defaults protect it, and the limits we found that you need to cover yourself. It is not a threat model. Each statement links to the page that shows it, or says what we ran. Reference architecture draws the boundaries.

How each path checks its caller

The chart's ingress sends every path to the server, so each path below is reachable from wherever your ingress is. The table lists the main paths, not every route.

Path	Who calls it	How the caller is checked
/token	Clients	Client authentication by secret or signed assertion. A public client has no secret, and on the code grant it proves the request with its PKCE verifier. See Register a client.
/revoke	Clients	The same client authentication as /token. A request with no client credentials revokes only a token issued to a public client, because holding the token is the proof. See Revocation.
/bc-authorize	Clients	Client authentication by secret or signed assertion. A public client is refused with unauthorized_client.
/authorize	A person in a browser	The person signs in at an identity provider that policy picks. See Trust and identity.
/register	Any client	No credential. What a new client gets comes from policy, and a software statement's signature is checked by default. See Register a client.
/introspect	Your APIs	A bearer token with the right scope, or Basic auth. See Check a token at your resource server with introspection.
/gateway/mcp, /gateway/{name}/**	Clients and agents calling upstream APIs	A bearer token, which the gateway checks at /introspect for each call. A token bound with DPoP also needs a proof. See How the managed gateway works.
/access/**	Your services asking for an AuthZEN decision	A bearer token or Basic auth. The admin key alone is refused. See Ask for a decision with AuthZEN.
/userinfo	Clients reading a signed-in user's claims	A bearer access token with the openid scope
/permission, /resource_registration/**	Your UMA resource servers	A bearer token with the uma_protection or the introspection scope. A token with only introspection listed resources at /resource_registration/resource on our test instance.
/delegation	Clients managing UMA delegations	A bearer token with the delegation_management scope
/admin/**	Administrators	An admin key in X-Admin-API-Key. See Rotate keys and secrets.
/bundles/**	OPA	The bundle key in X-Bundle-API-Key
/.well-known/**, /actuator/health, /actuator/prometheus	Anyone	No check

Defaults that protect an instance

• The server refuses to start without its five secrets, and refuses the public development values. Harden an instance lists them.
• Rate limiting is on. Each replica allows 1000 requests per 60 seconds from one address on the OAuth endpoints, /gateway/mcp, /gateway/link and /gateway/connect. Harden an instance lists the endpoints and settings.
• When the server fetches a client key set, a client metadata document or a software statement issuer's discovery document, it requires HTTPS and refuses private addresses. It does not check the identity provider discovery document and key set it fetches at sign-in, or the SPIFFE trust bundle. Data handling gives the detail.
• Client secrets are BCrypt hashes. Connector secrets, identity provider secrets, admin keys, signing keys and each user's upstream credentials are encrypted with PBAC_CREDENTIAL_KEY. See Data handling.
• The chart's pods run as non-root users with read-only root file systems and no Linux capabilities, and its network policies are on.
• The chart's database URL sets sslmode=require.

Limits to plan for

Each limit below is in the code or the chart today.

Limit	What to do
Any admin key can read the plaintext of every other admin key	Give each caller its own key and revoke unused ones. See Harden an instance.
/actuator/prometheus answers without a key, and /v3/api-docs does too while PBAC_SWAGGER_ENABLED is true, its default	Block the metrics path at your ingress and set PBAC_SWAGGER_ENABLED=false. See Harden an instance.
Traffic between the server and OPA is plain HTTP, and OPA's decision API takes no key	Keep the chart's network policies on, in a cluster whose network plugin enforces them
Access and refresh tokens are stored as issued	Anyone who can read those tables can use a live token. Limit database access as you limit admin keys.
The audit tables refuse changes through triggers that the database owner can disable, and the server's own database role owns the tables	Keep the server's database credentials as closely as the admin key. See Audit log.
OPA writes each decision's full input to its log, including the user's claims and IP address	Send OPA's log to a store you protect like the audit log. See Data handling.
When OPA cannot answer, /token returns HTTP 500 and writes no audit row, and the readiness probe stays up	Alert on OPA errors. See Availability and recovery.