All external access to Yapster is via the API. Authentication to the API is via revocable signed JWT tokens:
revocation is by de-registering (on the back-end) an id asserted within the token;
JWT tokens may also be time-limited.
JWT tokens may be issued directly to a user:
such tokens will remain valid until the user is de-activated or all their tokens are revoked.
JWT tokens may be issues to a device address:
an email address belonging to a user - the email address may be associated with the user either by the enterprise or a trusted manager.
a mobile number belonging to a user - the mobile number may be associated with the user either by the enterprise or a trusted manager.
JWT tokens issued to a device address will be revoked if the device address is deregistered from the user.
A delegated auth principal may have rights to request JWT tokens on behalf of users:
delegated auth principals have an ID and share a secret with Yapster;
JWT tokens issued by an auth principal are revoked if that principal is disabled or removed.