Desktop connector identity API (experimental)
QGIS uses a public OAuth device client with explicit browser approval. The provider issues access/refresh tokens. The gateway introspects each access token, validates issuer, subject, audience, client and expiry, and resolves the existing Workspace account. Email matching and automatic enrollment are not performed.
GET /api/v1/connector/config returns issuer and client_id, or 503 when disabled.
POST routes require Authorization: Bearer <provider access token>, JSON and no
browser Cookie/Origin headers:
Suffix under /api/v1/connector/ |
Input / purpose |
|---|---|
workspace |
{}; readable projects and organization context |
rpc/ListAssets |
{project_id}; authorized asset discovery |
catalog/describe |
{reference:{project_id,asset_id,revision}}; exact scientific description |
maps/snapshot |
Same exact reference; portable bounded scalar map |
maps/watch |
{project_id,asset_id,after,timeout}; revision notification hint |
maps/operate |
{reference,operator:"scalar-offset/1",delta,command_id} |
Administrative RPCs are not exposed. Scientific reads/operations enforce native project grants. Watches recheck authorization after waiting. Fetch exact payloads separately from revision hints. Operator requests retain the existing idempotency, publisher-policy and expected-revision conflict semantics.
QGIS renews credentials directly with the provider and stores refresh credentials in its encrypted authentication database. Disconnect uses token revocation, not global browser logout. Requests fail closed when identity verification fails. The gateway bounds cached native mappings to 256; introspection still occurs per request. This is not a measured 256-user capacity claim.
The provider must support device flow, renewable tokens, introspection, revocation and the correct Workspace audience. Keycloak is the qualified example; another provider needs equivalent tests. This connector acts with the account’s existing project permissions, distinct from narrowly scoped automation credentials.
Scalar-map scientific contract · Live API · QGIS user steps.