Machine access

Background lifecycle polling and product attestations need a service identity separate from a person’s browser login. Management validates machine access tokens for taifa-management, exact roles, and a project ID, then checks a reviewed service record where the operation requires one. The owned Go issuer does not yet issue general client-credentials tokens, so this is an integration contract, not a runnable token-minting recipe.

Lifecycle consumer

Give one product a dedicated service identity with the lifecycle-consumer management role and its approved project_id. Call GET /v1/lifecycle/{project_id}?after=CURSOR with a renewed access token. The API refuses a token whose project claim does not match the path or whose project is not approved. Verify each signed event and receipt with the dedicated lifecycle key, not the OIDC signing key. Poll every 15 seconds and keep the cursor durably with the applied product changes. See eligibility and lifecycle.

Account-link attestor

A product that proves an existing local account needs an independently reviewed service identity with the account-link-attestor capability for that exact project. The service must attest fresh local and central proof to the scoped account-link API. A role claim alone does not authorize it; management checks the approved issuer, subject, project, capability and current service state. The product must acknowledge the exact installed binding after its transaction commits. Read identity and account mapping.

Credential handling

Keep machine credentials in a server-side secret manager and rotate them separately from browser client secrets and OIDC signing keys. Use separate identities per product and environment. Plan token renewal and revocation; do not paste a human access token into a daemon configuration. Provisioning and token issuance for these clients remain part of the owned-engine multi-client release gate.

Internal issuer-to-management admission and authority lease calls use dedicated private HMAC and signing keys. They are not public OAuth client credentials and are not available to product applications.