For: Architects, and Builders who want the mental model before the code. Time: ~30 min end-to-end. Prereqs: Quickstart — authserver running locally.
Authplane vocabulary lives here. Every page below assumes nothing beyond this primer; read in order if the topic is new.
- What is Authplane — the envelope.
- Resources and scopes — Mint vs Broker vs Fronted.
- Tokens and claims — JWT shape, agent_id, audience.
- Identity and federation — users, IdPs, OIDC, XAA.
- Delegation and agent chains — token exchange in plain terms.
- DPoP and proof of possession — sender-constrained tokens.
- Broker vs Mint — the disambiguation page.
- Architecture — hexagonal layers, where the ports sit.
- Threat model — what we defend against.
- "AS" = authserver. "RS" = resource server (your MCP server).
- All code examples are illustrative pseudo-shape, not runnable. Runnable code lives in examples/.
- All RFC references link to the IETF datatracker.
See glossary.md — every term used below has an entry.