Token Validation

Status: 🌿

Motivation

Build stronger engineering judgment for authentication boundaries, API contracts, and frontend resilience.

Separate transport/auth gateway failures from domain validation results in your API contracts.
Define explicit response semantics so frontend can distinguish session/auth issues from network/runtime failures.
Prefer least-privilege service credentials for machine-to-machine checks; avoid reusing end-user tokens for system validation paths.
Standardize error taxonomy (auth, permission, validation, transient, internal) across endpoints.
Add observability for auth flows: reason codes, correlation ids, rate limits, and alert thresholds.
Review token lifecycle design: issuance, TTL, rotation, revocation, and secret handling.

Write one ADR for auth-boundary decisions in each integration project.
Create contract tests that assert auth and error behavior, not only success paths.
Run periodic incident reviews focused on "can the client decide correctly from the response?".