Open REST API with OAuth 2.0 Client Credentials for Third-Party Integration

Given a registered API client with invoices:read scope

when the client requests an access token via OAuth 2.0 Client Credentials and calls GET /v1/invoices, then a JWT is issued with scoped claims and the invoices are returned

when the client exceeds its RPM limit, then 429 with Retry-After header is returned

Developer registers an API client in the developer portal, selects scopes (e.g., invoices:read, payments:write), and receives client_id and client_secret. The third-party app requests an access token via OAuth 2.0 Client Credentials grant;
the auth service validates credentials, enforces requested scopes against org policy, and returns a JWT with ≤15-min TTL and scoped claims. The app calls Rivane API endpoints;
the router validates the JWT, checks FGA/OPA for scope + resource authorization, and processes the request. Rate limits are enforced per client. API usage metrics are visible in the developer portal.

Given a registered API client with invoices:read scope;
when the client requests an access token via OAuth 2.0 Client Credentials and calls GET /v1/invoices, then a JWT is issued with scoped claims and the invoices are returned;
when the client exceeds its RPM limit, then 429 with Retry-After header is returned;
(negative) when the client requests a scope not granted in org policy, then the token request returns 400 INVALID_SCOPE.

api_client { client_id: string, org_id: string, name: string, secret_hash: string, scopes: string[], status: enum(ACTIVE,REVOKED), external_id: string };
api_token { jti: string, client_id: string, scopes: string[], issued_at: timestamp, expires_at: timestamp };
rate_limit_counter { client_id: string, window_start: timestamp, request_count: int };
(reference, product may differ).

POST /oauth/token { grant_type: client_credentials, client_id, client_secret, scope } -> 200 { access_token, token_type, expires_in, scope };
POST /oauth/token { grant_type: authorization_code, code, code_verifier } -> 200 { access_token, refresh_token };
POST /v1/api-clients { name, scopes[] } -> 201 { client_id, client_secret };
POST /v1/token/introspect { token } -> 200 { active, scope, exp };
emits api.token_issued and api.rate_limit_exceeded events;
idempotent via external_id.

ACTIVE;
terminal REVOKED;
guard: client_secret stored as bcrypt hash (never recoverable);
token TTL ≤15 min;
scopes deny-by-default;
rate limit 429 on RPM breach.