Glossary
| Term | Definition |
|---|---|
| SSO | Single Sign-On — one login grants access to every CamelTech app via the shared browser session |
| OAuth 2.0 | Authorization framework; Camel Accounts implements the authorization-code grant |
| OIDC | OpenID Connect — identity layer on OAuth 2.0 (discovery, JWKS, userinfo) |
| JWT | JSON Web Token — the RS256-signed access token format |
| Access token | Bearer JWT, 15-minute TTL, carries sub/scope/aud claims |
| Refresh token | Opaque 43-char token, 30-day TTL, rotates on every use |
| Token family | The chain of rotated refresh tokens for one user+client; revoked wholesale on reuse detection |
| Authorization code | Single-use, 90-second code returned to your redirect_uri |
| PKCE | Proof Key for Code Exchange — code_verifier (secret) + code_challenge (its SHA-256); S256-only here |
| JWKS | JSON Web Key Set at /oauth/jwks — public keys for local JWT verification |
| kid | Key ID in a JWT header; selects which JWKS key verifies the signature |
| jti | Unique token ID claim; backs immediate access-token revocation |
| Discovery document | /.well-known/openid-configuration; lets libraries auto-configure endpoints |
| userinfo | GET /oauth/userinfo — scope-gated identity claims for a bearer token |
| sub | Subject claim — the user's permanent UUID; the only safe cross-app user key |
| Scope | Requested data permission: openid, profile, email, phone |
| Consent screen | Approval UI where users see what an app will receive; reappears on scope expansion |
| Redirect URI | Exact-match callback URL registered per client |
| Public client | No secret (SPA/mobile) — PKCE is the only protection |
| Confidential client | Holds a cask_… secret, required at /oauth/token |
| cask_ secret | Console-generated client secret: cask_ + 43 base64url chars, shown once, stored hashed |
| Session cookie | camel_session — HttpOnly browser session, 30-day sliding |
| Cockpit | The user-facing account portal on the issuer domain (login, consent, sessions, connections) |
| Developer console | console.camelcreatives.com — self-service projects/clients/branding/audit |
| TOTP / MFA | Time-based 6-digit codes from authenticator apps, required at password login once enabled |
| OTP | One-time 6-digit code delivered by email/SMS for verification or SMS reset |
| Passkey | WebAuthn/FIDO2 credential; a successful assertion is full authentication replacing password AND MFA |
| X-Passkey-Token | Opaque header binding a passkey ceremony's challenge (single-use, 3-min TTL) |
| argon2id | Memory-hard password hashing used for all stored passwords and OTP hashes |
| Theft detection | Reuse of a rotated refresh token → entire family revoked immediately |