Authentication

Token Issuance

All API access is governed by OAuth 2.0 client credentials flow over mTLS-terminated connections. A POST request to /v1/auth/token returns a signed JWT bearing the tenant’s permission scope, region affinity, and a 15-minute expiry window. Tokens are issued by Meridian’s distributed credential authority, which replicates across three availability zones to eliminate single-point-of-failure exposure during peak issuance load.

Scoping & Permissions

Each token payload encodes a permission set derived from the role assigned to the service principal at provisioning time. Granular scopes — such as inference:read, pipeline:write, and telemetry:export — are evaluated at the edge before any request reaches the data plane. Attempts to invoke endpoints outside a token’s declared scope return a 403 SCOPE_VIOLATION with a structured error body detailing the missing permission.

Token Rotation & Revocation

Meridian enforces automatic rotation for all production credentials on a 30-day cycle, triggered server-side without requiring client-side intervention. Revocation propagates to all edge nodes within 250 milliseconds via an event-sourced invalidation bus. Emergency revocation endpoints allow security teams to invalidate a compromised credential globally in a single API call, with full audit trail written to the immutable compliance log.