Identity and credential model for integrators

Choose the principal model before choosing an API or credential. DotID deliberately separates human console identities from Account-owned automation.

Use case

Principal

Credential

Control plane

Workforce CLI

Workforce user

Temporary ASIA access-key id, secret, and signed session token issued by DotID STS

Tenant-external capability APIs through the public API edge, with workforce permission-set authorization.

Long-running Account automation

Service user

Access key ID and one-time secret

Account service-user, role, policy, and credential operations.

CI/CD or runtime federation

Workload identity

External OIDC subject token exchanged for a short-lived DotID token

Workload-identity and RFC 8693 token-exchange operations.

Organization workforce console

Workforce user

Local or external-IdP human authentication

Private first-party browser APIs for Identity Center user/group, permission-set, and Account-assignment operations.

Platform administration

Platform administrator

Browser session with platform-admin realm/role

Admin-console web app and private same-origin admin APIs only; never CLI or the public API edge.

Service users have no password, Profile, or console access. Workforce users never live in an Account realm or Account user list. Account root users are platform-realm identities and are not returned by service-user APIs.

Keep the API planes separate

  • Browser applications call private same-origin browser/BFF routes with browser sessions.

  • The fgai CLI and external integrations call only public capability APIs exposed through the public API edge, using a static AKIA AK/SK or a temporary ASIA STS credential. The temporary shape is available to any principal through sts assume-role, not only to workforce users (PLT-0079 Amendment A).

  • Human OAuth/OIDC bearer tokens, including platform-admin tokens, are not CLI credentials.

  • Creating the first root user together with a standalone Account is browser-only. Creating a member Account inside an existing Organization is tenant self-service and may be exposed through the public API edge and the CLI.

  • SCIM, when delivered by the v2.5 milestone, will use a dedicated protocol ingress and is not a browser, CLI, or generic external-API alias.

Do not copy a browser route into a CLI integration or publish a first-party route through the public API edge to make it convenient. Add or amend the owning contract instead.

Secret handling

Service-user access-key and future SCIM-token secrets are one-time receipts. Persist only the verifier server-side, display the secret once, and move it directly into a secrets manager. Workforce STS credentials are short-lived and must include their session token in the signed request. Workload identity federation avoids a long-lived secret and should be preferred for CI/CD runtime workloads, but its exchanged bearer token is not a CLI command credential.