Identity SDK

.NET — `[RequirePermission]`

An IAsyncAuthorizationFilter for your endpoints (RequirePermissionAttribute.cs):

[HttpGet("/wallet"), RequirePermission("wallet.read")]
[HttpPost("/wallet/admin"), RequirePermission("wallet.admin", ServerCheck = true)]

Default (ServerCheck=false) — reads JWT claims (AxowlPrincipalAccessor.HasPermission, wildcard-aware), no round-trip.
ServerCheck=true — calls IAxowlIdentityClient.CheckPermissionAsync; fails closed (deny) on network failure.

JS/TS — `usePermission` / `requirePermission`

const { can } = usePermission();   // React: can('report.view')

app.get('/api/reports', requirePermission('report.view'), handler);  // Express middleware

Python — `verify_token` / `AxowlAuth.require`

ctx = verify_token(token, AxowlConfig(org_slug="my-org"))     # claims fast path
has_permission(ctx.permissions, "report.view")

@app.get("/reports")
def reports(ctx: AxowlContext = Depends(auth.require("report.view"))):   # FastAPI, 403 on miss
    ...

Server-authoritative: AxowlIdentityClient(api_key).check_permission(token, "report.view"). Full page: Python SDK.

Java — `AxowlTokenVerifier` / `Permissions.require`

AxowlContext ctx = verifier.verify(token);              // claims fast path
Permissions.require(ctx, "report.view");                // throws AxowlPermissionException

Server-authoritative: new AxowlIdentityClient(apiKey, baseUrl).checkPermission(token, "report.view"). Full page: Java SDK.

Server-authoritative resolution

The gRPC IdentityService (Introspect, CheckPermission, IdentityServiceImpl.cs:43,72) authenticates with the org API key (Bearer ah_live_…), validates the user token against the org RS256 JWKS, and reads permissions fresh from ConnectedIdPermissions (:226) so revocations apply immediately. Wildcard matching: *, x.*, exact (MatchScope, :263).

Introspect response

Introspect (gRPC, or REST POST /v1/identity/introspect) returns the resolved principal. The same fields surface on AxowlPrincipal in .NET:

Field	Meaning
`active`	`false` = expired / invalid / revoked. All other fields are empty when inactive.
`end_user_id`	The end user’s id in this org.
`organization_id`	The org the token was issued for (must match your API key’s org).
`connected_id`	The user’s org identity badge (ConnectedId). Issued to every end user — customer or employee — one per org. This is the subject that permissions, seals, and billing attribution key on.
`is_employee`	Server-authoritative at introspect time: `true` when the badge’s subject is an internal org member. Do not infer employment from `connected_id` being present — it always is.
`permissions`	Fresh `ResolvedScope` list (revocations already applied).

Identity SDK

.NET — [RequirePermission]

JS/TS — usePermission / requirePermission

Python — verify_token / AxowlAuth.require

Java — AxowlTokenVerifier / Permissions.require