/health and /ready requires a verified OIDC bearer token or controlled development authentication. /metrics also requires viewer permission.
JWT verification
The server verifies issuer, audience, JWKS signature,exp, iat, and sub. The tenant is derived only from the verified claim named by LINGXIGRAPH_TENANT_CLAIM (default tenant_id). Roles come from LINGXIGRAPH_ROLES_CLAIM (default roles).
Fixed roles
An endpoint usually accepts one or more listed roles;
tenant-admin covers every action in its tenant. Resource queries always include the tenant predicate, and transaction-local app.tenant_id activates PostgreSQL RLS.
Local development auth
lingxigraph dev sets LINGXIGRAPH_INSECURE_DEV_AUTH=true. You can then use:
X-API-Key can also carry a configured development key. Keep development auth bound to localhost or a controlled network; never expose it publicly.