Private access · private API boundary
Keep identity, scope, and workspace together
Understand private-access sign-in and service access without creating a key or starting an authorization flow from this page.
Browse only. This page does not contact account data, credentials, MCP sessions, or a product runtime.
Public contract example
Access is a bounded grant, not a reusable master key
A service or client receives the smallest audience and scope set for one workspace, with an explicit expiration and revocation path.
- Audience
- tempera-workflows · tempera-connectors · tempera-mcp · tempera-llm
- Workspace
- organization · project · environment
- Scope
- the smallest grant required for the named job
- Lifetime
- expiration, rotation, and independent revocation
What this surface owns
The public record shows the contract a buyer can inspect. Configuration, credentials, and effectful actions remain inside a provisioned workspace.
- 01Private workspace
Scoped API keys
Bind a service key to one resource audience, workspace, scope set, and expiration.
- 02Private workspace
OAuth and connected clients
Let an interactive client request a narrow grant without receiving a password or reusable service key.
- 03Private workspace
Rotation and revocation
Replace or revoke a credential independently so the next protected request fails closed.