​

Authentication

Moveat uses different authentication mechanisms for different consumers.

​

Web authentication

The web app uses opaque HTTP-only sessions. After login or signup, Platform creates a session and sends it to the browser as a cookie. The frontend does not read the token directly.

​

Why opaque sessions

Opaque sessions allow Platform to revoke or expire sessions server-side. The browser only holds a random session identifier, not the full user claims. This reduces exposure if frontend JavaScript is compromised.

​

Google authentication

Google login uses a Google ID token obtained by the frontend. Platform verifies the token against the configured Google client ID and then creates or links the local Moveat user. The frontend needs the Google client ID to show the Google account selector.

​

Internal service authentication

Agent authenticates to Platform with an internal service token. This token is not a user session. It identifies the calling service and protects /internal/v1 APIs.

​

Auth boundaries

​

Sensitive operations

Sensitive operations should require strong authorization and should be protected from CSRF where browser cookies are involved. Examples:

• Account deletion.
• Email change.
• Password change.
• Channel unlinking.
• Exporting user data.