Authentication and Authorization

Overview

DMTR supports multiple authentication mechanisms to suit different integration patterns. API keys provide simple programmatic access; OAuth 2.0 enables user-delegated flows; SAML supports enterprise SSO; service accounts support machine-to-machine workflows.

API keys

API keys are the primary method for server-to-server integrations. Keys are scoped to an organization and environment (sandbox or production). Rotate keys periodically and never expose them in client-side code or public repositories.

OAuth 2.0

OAuth 2.0 authorization code flow with PKCE is supported for user-facing applications. Use OAuth when your application needs to act on behalf of a user with their consent. Tokens are short-lived; refresh tokens enable extended sessions.

SAML and SSO

Enterprise customers can configure SAML 2.0 identity providers for single sign-on. SAML enables centralized identity management and consistent access policies across the organization. Contact your account team for SSO setup.

Service accounts

Service accounts are non-human identities for automated workflows, CI/CD, and backend services. They use API keys or OAuth client credentials. Scope service account permissions to the minimum required for the workflow.

Role-based access control

The API enforces role-based access control (RBAC) via middleware on all /v1/ routes. The RBAC module (evaluateAccess() in @dmtr/core) supports the following roles: admin, gp, lp, transfer_agent, counsel, auditor, lender, borrower.

Each request is evaluated against a permission matrix mapping roles to actions (read, write, evaluate, settle, consent, audit) on specific resource types. Denied access returns a 403 response.