AxAxolite Docs
AuthSecurity

Authentication

Token types and permission model for Teams, Clients, and MS Auth.

Token types

TokenUsed forCommon mistake
dashboard_tokenTeam owner/admin routes (/teams, /client/apps, /server/servers)Using it for launcher machine auth
client_secretClient-to-Axolite service calls (/client/ms-auth/*)Embedding it in a public launcher binary
axolite_session_tokenSession token after user consent in MS auth flowReusing without validation

Team and ownership model

  • Every team has one owner (the user who created it).
  • Roles are owner, admin, member, viewer.
  • Authorization is evaluated as token + team membership + route policy.

Client credential model

  • Each client has client_id and client_secret.
  • client_secret is only returned on creation and rotation.
  • Always store client_secret server-side.

OAuth with Microsoft

  1. Client backend calls /client/ms-auth/start.
  2. User authenticates with Microsoft URL from auth_url.
  3. Axolite handles callback at /client/ms-auth/callback.
  4. User accepts consent at /client/ms-auth/authorize.
  5. Client polls /client/ms-auth/poll.
  6. Validate session using /client/ms-auth/session/validate.

Gotchas

  • Missing module activation returns 400 on /client/ms-auth/start.
  • Missing network_name for network servers returns 400.
  • Expired auth request returns expired status from consent endpoint.

Troubleshooting

  • Rotate client secrets immediately on leak.
  • Do not expose client secrets in browser JS or launcher binaries.
  • Always validate axolite_session_token before login success.
StartEnd