Authentication

Billing exports must use dedicated credentials. Do not require the same secret used to run inference.

Core: scoped bearer token

A Core implementation must support a dedicated bearer token with:

• Read-only access bound to the customer billing account
• Separate scopes for usage and cost
• Revocation, optional expiration, and rotation
• One-time display when created

Recommended scopes:

• billing.account.read
• billing.usage.read
• billing.cost.read

The token must not grant inference, key management, user management, or billing mutation permissions.

Delegated: OAuth Authorization Code with PKCE

A Delegated implementation must use OAuth 2.0 Authorization Code with PKCE S256 (RFC 9700) and:

• Customer-admin consent
• Exact redirect URI matching
• Audience-restricted access tokens
• Refresh tokens suitable for unattended sync, with rotation and replay detection
• Provider-side grant revocation
• RFC 8414 authorization-server metadata
• RFC 9728 protected-resource metadata
• The profile scopes advertised in capabilities

Access tokens should expire within 60 minutes. For confidential clients, private_key_jwt is preferred; client_secret_basic is acceptable for v0.1.

OpenID Connect is not required. Client-credentials may be used for customer-managed service principals, but it is not the default delegated consent flow.

HTTP auth failures

• 401 for missing or invalid credentials
• 403 for a valid credential that lacks scope or account access
• Non-2xx responses should use RFC 9457 problem documents
• Rate limits should send Retry-After on 429 (and temporary 503)