Skip to content
AxecAxec Docs

Act on behalf of a User

Use delegated authority when an Application performs work for a signed-in User. Authorization Code with S256 PKCE produces a User-principal gateway bearer and a GrantBundle containing independent Connector Grants. It does not give the Application general tenant-management authority.

Prerequisites

Section titled “Prerequisites”
  • A registered public or confidential Application OAuth client.
  • A registered callback URI.
  • The exact target gateway Resource.
  • Browser access for login, upstream connection, and consent.

Authorize with the TypeScript SDK

Section titled “Authorize with the TypeScript SDK”
import { AxecAuthClient, MemoryStorage } from "@axec/sdk";


const resource = "https://axec.example.com/g/release-copilot/mcp";
const auth = new AxecAuthClient({
  baseUrl: "https://axec.example.com",
  clientId: "public-client-id",
  redirectUri: "http://127.0.0.1:3000/callback",
  storage: new MemoryStorage(),
});


auth.startAuthorization(resource, {
  scopes: ["mcp:invoke"],
  allowedConnectors: ["internal-tickets"],
});

After the User completes login, Connection setup, and consent, redeem the callback:

const token = await auth.completeCallback(window.location.href);
const authority = await auth.grantBundle(resource);


console.log(authority.root_mode, authority.grants);

Request only the operations the client will use:

  • mcp:invoke for MCP tools;
  • connector:proxy for mediated internal API capabilities; or
  • credential:exchange for a governed, exact OAuth credential release from a confidential client.

Each operation also requires the matching Grant usage channel. A top-level token scope cannot widen a Grant.

Expected authority

Section titled “Expected authority”

The GrantBundle binds the User, requesting client Application, exact gateway Resource, and session or offline root mode. Each Grant pins one Connector attachment and its exact Connection or workspace credential provenance, scopes, capabilities, and contract digests.

Verify and revoke

Section titled “Verify and revoke”

Reload the GrantBundle before sensitive work and confirm the intended Grant is active. Axec repeats live checks on every gateway or SDK request, so revoking the exact Grant, its Connection, or the whole root removes future authority immediately. See Revoke a Grant or Connection.

Do not put a confidential client secret in browser code. For User-independent work on workspace-owned credentials, use an autonomous Application instead.

Continue

Section titled “Continue”