Skip to main content
Polymorfa separates human dashboard identity from three service credential kinds. A credential is valid only for its intended audience. Service credentials use distinct prefixes so they cannot be exchanged between credential types. Client tokens are not JWTs.

​
Bearer header

Use the exact token returned at issuance. Tokens are canonical strings; adding padding or whitespace is rejected. Secrets are displayed once and cannot be recovered from stored metadata.

​
Requestable project-token scopes

Project tokens use this scope catalog:
* grants every current project-token scope. Prefer the narrowest explicit set. Project ownership is checked in addition to the scope bit; a matching scope never authorizes cross-project access. The endpoint-only scope names widget:create, sandbox:read, and sandbox:write cannot be requested on a project token. Follow each endpoint’s documented credential requirements; having a scope name in another credential catalog does not make it valid for project tokens. Client tokens do not carry scope bits. Their access is controlled by the session’s exact allowedActions, recipient policy, origin rules, and rate limits. See Client tokens. Organization keys use the scope stated on each Platform API endpoint. The published operations use session, campaign, billing, project, and member read or manage scopes. The generated Platform API reference lists the required scope for each operation.

​
Dashboard authorization

Dashboard requests use a short-lived bearer and verify the active session, organization, membership, account status, and role on each request. Removing a member or ending a session takes effect without waiting for the bearer to expire. Account security supports passwordless email OTP, passkeys bound to the exact Console origin, TOTP, optional social providers, invitations, and device login.

​
Client and project boundaries

  • Project tokens cannot address a session, template, campaign, media object, or Meta-compatible identifier owned by another project.
  • Client tokens are short-lived and pass through the client-rules middleware.
  • MCP requires the project-token mcp scope or the client-token mcp action. Raw bridge connections require the project-token bridge:connect scope.
  • Each public Platform API operation (/v1/*) declares whether it accepts an organization key or requires a dashboard bearer. Project tokens are rejected.
  • Dashboard-only routes do not accept service credentials unless the operation’s OpenAPI security explicitly says they do.

​
Rotation and incident response

Revoke a suspected credential immediately from the Console or an explicitly documented revoke endpoint. Confirm that the old credential is rejected before closing the incident. Use the generated endpoint page for the exact issuance, metadata, and revoke shape. Never log or paste full credentials into a ticket.