docs(contract): device (mTLS) tokens now carry aud=axiam:m2m - #42
Merged
Conversation
Syncs CONTRACT.md from the server repo for a BREAKING change to the device-authentication path. POST /api/v1/auth/device used to return a token stamped aud=axiam:user, so a certificate-authenticated device passed every user-facing route guard. It now returns aud=axiam:m2m, matching the client-credentials path: both ways a service account can authenticate now yield a machine-audience token. No SDK code change is required — the device-auth call and its response shape are unchanged, only the aud claim value differs. What changes for SDK users: - A §10 guard fronting a resource server that accepts device callers must be configured to expect axiam:m2m. A guard configured for axiam:user will reject device tokens, correctly — that is rule 6 working, not a bug to work around. - Server-side, a device token no longer reaches user-facing REST routes. It is accepted on the authorization-check endpoints, which are the machine-facing surface. Any SDK device flow that called a different endpoint with the device token must migrate that call deliberately; the previous access was implicit, not designed. §10.1 rule 6 is updated to state the machine-facing case explicitly. Applied as a targeted patch, not a wholesale copy of the upstream file, so the vendored copies' pre-existing drift is preserved: 25 insertions and exactly one deletion, that deletion being the rule-6 row this change replaces. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SkTHvZQMV47t3UwkEtmB1D
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Syncs
CONTRACT.mdfrom the server repo for a breaking change to the device-authentication path.What changed upstream
POST /api/v1/auth/device(§6.1) used to return a token stampedaud: axiam:user, so a certificate-authenticated device passed every user-facing route guard. It now returnsaud: axiam:m2m, matching the client-credentials path — so both ways a service account can authenticate now yield a machine-audience token. The audience finally describes what kind of principal holds the token rather than which endpoint issued it.No SDK code change is required
The device-auth call and its response shape are unchanged; only the
audclaim value differs.What does change for users of this SDK
axiam:m2m. A guard configured foraxiam:userwill reject device tokens — that is rule 6 working, not a bug to work around.§10.1 rule 6 is updated to state the machine-facing case explicitly.
On the sync method
Applied as a targeted patch, not a wholesale copy of the upstream file, so the vendored copy's legitimate pre-existing drift survives. The diff is 25 insertions and exactly one deletion — that deletion being the rule-6 row this change replaces, verified byte-identical across all eleven SDKs before patching.
🤖 Generated with Claude Code
https://claude.ai/code/session_01SkTHvZQMV47t3UwkEtmB1D
Generated by Claude Code