Verifying sign-in across five different backends

Once we decided identity would be shared, the harder question was: shared how? Every app's backend is separate, sometimes in a different language, always on a different server. A shared secret key or a shared database was never going to work safely at that scale.

Asymmetric signing solves the wrong-hands problem

Our identity service signs every access token with RS256 — a private key only it holds. Every other app verifies that signature with the matching public key, published at a single URL. No app ever needs the private key, a database connection to another app, or even a network call back to the identity service on every request.

const jwt = require("jsonwebtoken");

const publicKey = await fetch(
  "https://api.datarobottechnologies.com/api/auth/public-key/"
).then((r) => r.text());

function requireAccount(req, res, next) {
  const token = req.cookies?.dbt_access
    || req.headers.authorization?.replace("Bearer ", "");
  try {
    req.account = jwt.verify(token, publicKey, { algorithms: ["RS256"] });
    next();
  } catch {
    res.status(401).json({ detail: "Not signed in." });
  }
}

The token already knows the answer

Each token's payload carries the account id and its current entitlements. Most authorization decisions need nothing beyond decoding the token — no round trip, no shared infrastructure. For the rare case an app wants a real-time check instead, a lightweight introspection endpoint is there too.