Skip to main content

Main Identity Service

The Identity Service is the centralized authentication and authorization layer for the entire Vecton platform. Every user — whether an admin, store manager, or warehouse operator — authenticates through this service.

For detailed documentation, see the dedicated Identity Service section.

Role in the Platform​

  Tenant Frontend ──┐
  Admin Frontend ───┤──▶ Identity Backend ──▶ PostgreSQL (identity schema)
  Identity Frontend ┘         │
                              ├──▶ Redis (sessions, rate limiting)
                              └──▶ Audit Log

The Identity Service acts as a gateway:

  • All frontends redirect to the Identity login page for authentication
  • All backends validate tokens against the Identity API via OAuth2 introspection
  • Service-to-service communication uses client credentials grants

Key Capabilities​

FeatureDescription
JWT/Sanctum TokensBearer token authentication with 24-hour expiry
Two-Factor Auth (2FA)TOTP-based (RFC 6238) with recovery codes
PIN Authentication6-digit PIN for quick access with brute-force protection
Password Policies12-char minimum, complexity rules, last-5 history
Device ManagementTrack and revoke sessions per device
OAuth2 ServerClient credentials for service-to-service auth
Audit Logging15+ event types with 365-day retention
Multi-TenantAll data scoped by tenant_id, full isolation

Tech Stack​

LayerTechnology
BackendLaravel 12 + Sanctum
FrontendVue 3 + TypeScript + Vuexy (Vuetify-based)
DatabasePostgreSQL 16 (identity schema)
CacheRedis 7
ServerFrankenPHP (Octane)

API Base URL​

EnvironmentURL
Productionhttps://identity.vecton.hu/api
Developmenthttp://localhost:8000/api

Integration​

Other services integrate with Identity via:

Token Validation (Backend-to-Backend)​

// Laravel middleware validates Bearer token against Identity API
// Automatic via Sanctum token guard
$user = Auth::user(); // Resolved from Bearer token

OAuth2 Client Credentials (Service-to-Service)​

curl -X POST https://identity.vecton.hu/api/oauth/token \
  -d "grant_type=client_credentials" \
  -d "client_id=YOUR_CLIENT_ID" \
  -d "client_secret=YOUR_CLIENT_SECRET" \
  -d "scope=service"

Login Redirect (Frontend)​

All tenant and admin frontends redirect unauthenticated users to the Identity login page. After successful login, the user is redirected back with a valid token.