Authentication#

Junction uses signed JWTs. There’s no database lookup on the request path — a token is valid if its signature verifies against the shared secret and its type claim matches what the endpoint expects.

Header#

X-Junction-Token: <token>

Missing or invalid → 401. See Errors .

Token types#

A token’s type must match the endpoint group it’s presented to — a relay token cannot call /v0 endpoints, a management token cannot call /relay, and so on.

Claims#

{
  "type": "relay|system|management",
  "id": "<token identifier>",
  "iat": 1783062656
}

Tokens do not expire — there is no exp claim. Revoke a token type entirely by rotating the shared secret.

Generating a token#

Tokens are generated with the Junction CLI:

junction token:create <id> --type=<relay|system|management>

<id> is a required, free-form identifier for the token (e.g. a worker name or calling system’s name) — it’s carried in the token payload but not otherwise enforced by the API.

junction token:create http_destination --type=system
junction token:create billing-service --type=relay

The command prints the signed token to stdout. Distribute it out-of-band to the calling system or worker deployment.