# Tokenx Auth

> Service-to-service authentication using TokenX token exchange in Nais Use when this capability is needed.

- Skill: `tomevault-io/tokenx-auth` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add tomevault-io/tokenx-auth`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/tokenx-auth/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: tomevault-io (https://skillmd.com/u/tomevault-io)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/tomevault-io/tokenx-auth

---


# TokenX Authentication Skill

`lumi-api` does **not** currently use TokenX. Authentication in this repo is based on Azure AD access tokens validated via NAIS Texas introspection.

Use this skill only if the team explicitly decides to introduce TokenX (typically for calling other internal services on behalf of a user).

## Preferred approach for this repo

- For inbound requests: keep using the existing Texas introspection setup in `no.nav.lumi.config.Auth`.
- For outbound calls: prefer explicit `accessPolicy` + ordinary service-to-service auth mechanisms already adopted by the platform/team.

## If TokenX is introduced (ask first)

### Nais manifest

```yaml
apiVersion: nais.io/v1alpha1
kind: Application
metadata:
  name: lumi-api
spec:
  tokenx:
    enabled: true
```

### Implementation boundaries

- Keep TokenX-specific code isolated (e.g. `config/TokenX.kt`) and covered by tests.
- Do not replace Texas introspection for inbound validation unless there is a clear migration plan.
- Never log tokens or include sensitive claims in logs.

## Boundaries

### ✅ Always

- Keep auth aligned with the existing Texas introspection approach unless there is a clear migration plan.

### ⚠️ Ask First

- Adding TokenX support (new auth mechanism + NAIS config)

### 🚫 Never

- Validate JWTs via JWKS in-app “just because” when the repo is already set up for Texas introspection.

---
> Converted and distributed by [TomeVault](https://tomevault.io/claim/navikt) — claim your Tome and manage your conversions.
<!-- tomevault:4.0:skill_md:2026-04-16 -->