API Key and Token Service · View 01 of 22 · Act 1 · Context and scope
Decisions
- The service answers "is this credential live, whose is it, what scopes does it carry" — never "is this request allowed". Product authorization sits outside the boundary and stays there.
- Scanning partners are modelled as callers of a verification interface, not as an integration: they get one bit back, under their own rate limit, with no authentication.
- The IdP and the key store are trust anchors, not dependencies of the request path. The request path can serve while both are unreachable.
Assumptions
- 400,000 tenants and 2.5 million live credentials — invented, and the number that decides whether a full projection fits in a verification point's memory.
- 250,000 verifications per second across three regions, 5× burst for 120 s.
- Three scanning partners integrated; a fourth costs nothing architecturally.
Out of scope
- End-user login, sessions, consent screens and SSO.
- What a scope permits in any product surface — this service publishes the vocabulary and reports membership.
- Billing. Usage is attributed to a credential and handed over; the rating is someone else's.
