tomevault-io TokenX Authentication Skill
lumi-api does not currently use TokenX. Authentication in this repo is based on Azure AD access tokens validated via NAIS Texas introspection.
Use this skill only if the team explicitly decides to introduce TokenX (typically for calling other internal services on behalf of a user).
Preferred approach for this repo
- For inbound requests: keep using the existing Texas introspection setup in
no.nav.lumi.config.Auth. - For outbound calls: prefer explicit
accessPolicy+ ordinary service-to-service auth mechanisms already adopted by the platform/team.
If TokenX is introduced (ask first)
Nais manifest
apiVersion: nais.io/v1alpha1
kind: Application
metadata:
name: lumi-api
spec:
tokenx:
enabled: true
Implementation boundaries
- Keep TokenX-specific code isolated (e.g.
config/TokenX.kt) and covered by tests. - Do not replace Texas introspection for inbound validation unless there is a clear migration plan.
- Never log tokens or include sensitive claims in logs.
Boundaries
✅ Always
- Keep auth aligned with the existing Texas introspection approach unless there is a clear migration plan.
⚠️ Ask First
- Adding TokenX support (new auth mechanism + NAIS config)
🚫 Never
- Validate JWTs via JWKS in-app “just because” when the repo is already set up for Texas introspection.
Converted and distributed by TomeVault — claim your Tome and manage your conversions.