Glossary
Glossary
| Term | Definition |
|---|---|
| Bearer token | Access token sent in the Authorization: Bearer header. Whoever presents it is authorized. |
| Callback | API address that the identity provider calls to complete an SSO flow. |
| Grant | Way to obtain a token in OAuth 2.0 (for example, password or token exchange). |
| HTTP Basic | Authentication with user and password encoded in Base64 in the Authorization header. |
| JWT | JSON Web Token: a signed token with statements (claims) about the user. |
| MFA | Multi-factor authentication: a second verification in addition to the password. |
| OpenAPI | Standard for describing HTTP API contracts; the basis of Swagger UI. |
| OAuth 2.1 | Revision of OAuth 2.0 that makes security practices such as PKCE mandatory and does not include the password grant. See OAuth 2.1 compatibility. |
| OpenID Connect (OIDC) | Identity layer on top of OAuth 2.0, used in SSO. |
| OTP | One-time password, sent by email or SMS. |
| PIN | Numeric confirmation code that some secure links require. |
| PKCE | Proof Key for Code Exchange: protection of the authorization code sign-in in SSO, required by OAuth 2.1. |
| Provider | Identifier of an identity or JWT provider registered in the environment. |
| SAML 2.0 | XML-based identity federation standard, used in SSO. |
| Secure link | Signed URL issued by the API for a specific operation (MFA, password, or download). It expires and can require a PIN. |
| Session cookie | __Host-dirl_session cookie, issued at local or SSO login, that identifies the authenticated session. |
| SSO | Single Sign-On: single login through a corporate identity provider. |
| Token exchange | OAuth 2.0 and 2.1 grant that trades a source token (JWT) for an API access token. |
| TOTP | Time-based code generated by an authenticator app. |