Auth and `user_token`

Downcity does not host your user system. It only requires a verifiable user_token on product-side requests.

If you already have login

After a user logs in, use FederationAdmin to request a Downcity token from Federation:

const user = await admin.service("accounts").action("tokens/issue").invoke({
  bureau_id: "demo",
  user_id: session.user.id,
  metadata: {
    plan: session.user.plan,
  },
  ttl: "7d",
});

Then give the product side two values:

• bureau_id
• user_token

If you do not have a heavy backend yet

For new pure-client products, keep token issuance near one Federation instead of building a separate service per product.

What the token should not do

• Do not put provider keys into the token.
• Do not put private billing rules into the token.
• Do not let the client hold administrator IDs, passwords, or session tokens.

The token only needs to express who the user is and which business metadata should travel with the request.