Identity & permissions

Access that stays bounded.

A token is a limited credential for your existing identity. It does not grant a new role or bypass ownership.

The authorization intersection

Valid token, matching environment, active grant, explicit scopes, current user status, existing host capability, resource ownership and business policy must all allow the request. A read grant cannot approve a booking. A write scope does not imply read access.

Own and staff records

Guests read their own records. Authorized booking staff can request an all-record grant, but a viewer remains unable to mutate. Manager operations require both the correct scope and current booking-manager access. Grant revocation is checked on requests and again inside mutations.

Token lifecycle

Default expiry 24 hours, maximum 7 days. At most 20 active tokens per user. Tokens are shown once and stored only as secret hashes. Account disablement, relevant sign-in revocation, token expiry and grant revocation invalidate them. Never share a token between environments.

GET    /api/v1/integration-tokens
POST   /api/v1/integration-tokens
DELETE /api/v1/integration-tokens/{id}

These management endpoints accept your existing verified Google Firebase ID token. They do not accept integration tokens. Creation requires a distinct idempotency key; its cleartext result is not replayable. A repeated issuance key returns TOKEN_ALREADY_ISSUED. Normal API calls use the resulting integration token.

Not included yet

Managed OAuth authorization, remote MCP transport, service principals and retention-aware account erasure require separate reviewed implementation. No user identity is synthesized for an external client, and no email-only ownership matching is used.