Authentication

VijiHub supports two primary credentials against the Gateway:

OIDC access tokens (Authorization Code + PKCE) — Console and user sessions
API keys (vh_…) via X-Api-Key — customer backends and scoped browser clients

OIDC / JWT

Identity is hosted on the Gateway via OpenIddict.

Item	Path / value
Discovery	`/.well-known/openid-configuration`
Authorize	`/connect/authorize`
Token	`/connect/token`
UserInfo	`/connect/userinfo`
Login UI	`/auth/login`
Register	`/auth/register`

Flow: Authorization Code + PKCE (no password grant to the token endpoint).

Client redirects to /connect/authorize.
Unauthenticated users complete /auth/login (or register / external providers).
Client exchanges the code at /connect/token.
Call APIs with Authorization: Bearer <access_token>.

TypeScript helper: @vijihub/auth. .NET helper: VijiHub.Auth.

Seeded Console client (Development): vijihub-console with redirect http://localhost:5500/auth/callback.

API keys

Project API keys are created in the Console under the project. Send:

X-Api-Key: vh_...

Key scopes

Scope	Typical use
`*` / empty	Full server key — backends, admin APIs, Maps data, Storage admin, push send
`analytics:ingest`	Browser/server ingest for Analytics
`crashlytics:ingest`	Crash report ingest
`messaging:live`	Messaging live / SignalR clients
`notifications:register`	Device registration from browsers

Never embed an unrestricted full key in a public frontend bundle. Prefer scoped client keys or a BFF that holds the full key.

Dual-auth endpoints

Many project-scoped routes accept either a valid owner JWT or an API key with sufficient scope. Service pages document which auth mode each route requires.

Auth UI rate limits