jacob-mathison/query-orchestration
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Activity

Merged in feature/service-accounts-1 (pull request #227)

Browse Source 
Support for service accounts with static credentials

* feature complete

* tests and docs

* lint fix
This commit is contained in:
Jay Brown
2026-05-21 19:40:04 +00:00
parent e3d9047143
commit 451da3d26d
63 changed files with 4347 additions and 11179 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/ai.generated/09-authentication-guide.md
+2
View File
@@ -19,6 +19,8 @@ This document provides technical instructions for frontend (UI) developers integ
The Query Orchestration API uses **JWT (JSON Web Token) authentication** with tokens issued by **AWS Cognito**. The authentication flow assumes that the UI application handles user login directly with Cognito and obtains the necessary tokens.
> **Service-account callers (non-UI processes):** queryAPI also accepts JWTs from a second Cognito user pool dedicated to service accounts. The flow is different (Cognito `InitiateAuth` with username/password instead of OAuth + PKCE + MFA) and the lifecycle is operator-driven via a CLI tool. See [13-two-pool-service-accounts.md](13-two-pool-service-accounts.md) for the full reference. Everything below in this guide describes the human-user (pool A) path.
### Token Types
When a user authenticates with Cognito, your UI receives three tokens: