Skip to main content

Authorization

info

The epilot application uses standard OAuth 2.0 tokens (JWT) for authorization.

Authorization Header​

Pass a valid bearer token in the Authorization request header to authorize API requests:

Authorization header
Authorization: Bearer <your-access-token>

API Gateway Authorizer​

All requests to epilot APIs pass through an API Gateway authorizer that validates the bearer token and extracts claims. Backend microservices receive these claims as verified context.

Permissions API​

The JWT token identifies the user (user ID, organization), but does not encode what the user can do. To check whether a user can perform a specific action, call the Permissions API.

Check permissions
import { tokenIsPermitted } from '@epilot/permissions'

const isPermitted = await tokenIsPermitted(context.token, 'myaction')

See the full Permissions documentation for details on roles, grants, and evaluation logic.

See Also​