Identity SDK

.NET — `[RequirePermission]`

An IAsyncAuthorizationFilter for your endpoints (RequirePermissionAttribute.cs):

[HttpGet("/wallet"), RequirePermission("wallet.read")]
[HttpPost("/wallet/admin"), RequirePermission("wallet.admin", ServerCheck = true)]

Default (ServerCheck=false) — reads JWT claims (AxowlPrincipalAccessor.HasPermission, wildcard-aware), no round-trip.
ServerCheck=true — calls IAxowlIdentityClient.CheckPermissionAsync; fails closed (deny) on network failure.

JS/TS — `usePermission` / `requirePermission`

const { can } = usePermission();   // React: can('report.view')

app.get('/api/reports', requirePermission('report.view'), handler);  // Express middleware

Server-authoritative resolution

The gRPC IdentityService (Introspect, CheckPermission, IdentityServiceImpl.cs:43,72) authenticates with the org API key (Bearer ah_live_…), validates the user token against the org RS256 JWKS, and reads permissions fresh from ConnectedIdPermissions (:226) so revocations apply immediately. Wildcard matching: *, x.*, exact (MatchScope, :263).

Introspect response

Introspect (gRPC, or REST POST /v1/identity/introspect) returns the resolved principal. The same fields surface on AxowlPrincipal in .NET:

Field	Meaning
`active`	`false` = expired / invalid / revoked. All other fields are empty when inactive.
`end_user_id`	The end user’s id in this org.
`organization_id`	The org the token was issued for (must match your API key’s org).
`connected_id`	The user’s org identity badge (ConnectedId). Issued to every end user — customer or employee — one per org. This is the subject that permissions, seals, and billing attribution key on.
`is_employee`	Server-authoritative at introspect time: `true` when the badge’s subject is an internal org member. Do not infer employment from `connected_id` being present — it always is.
`permissions`	Fresh `ResolvedScope` list (revocations already applied).