Authentication · Verentis Developer

Every Verentis API call is authorised with a short-lived access token. How you obtain that token depends on how your extension runs.

The three paths to a token

App runtime — injected tokens

When your app runs in a workspace iframe, the SDK bridge injects short-lived tokens scoped to the signed-in user and your app's granted permissions. You don't manage credentials. See The SDK & bridge.

Standalone development — CLI device sign-in or API key

Outside the platform, sign the CLI in with the device flow (verentis login — approve in any browser, works over SSH), or authenticate non-interactive tooling with an API key exchanged for access tokens.

Engine run — engine token

Each engine run gets a token minted by the platform, scoped to the engine's declared permissions and the run context. Used via the language SDK.

OAuth for apps

Apps that need their own identity declare an OAuth client in their manifest:

spec:
  oauth:
    client-type: public          # public (browser) or confidential (has a backend)
    redirect-uris:
      - https://app.example.com/auth/callback

public clients (browser apps) use the authorization-code flow with PKCE and hold no secret.
confidential clients (apps with a secure backend) can hold a client secret.

The OAuth redirect (callback) URL for an environment is served by the API gateway. In the current environment it is:

https://api.sprint-6.verentis.dev/connect/callback