Skip to content

docs: clarify project membership as a trust boundary for auth #1089

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
wdawson merged 1 commit into from
Jul 21, 2026
+15 −7
Merged

docs: clarify project membership as a trust boundary for auth #1089

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 13 additions & 7 deletions app/en/guides/user-facing-agents/secure-auth-production/page.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,11 +32,14 @@ When you authorize a tool, you'll be prompted to sign in to your Arcade.dev acco
The Arcade.dev user verifier helps keep your auth flows secure while you are building and testing your agent or app. When you're ready to share your work with others, implement a [custom user verifier](#build-a-custom-user-verifier) so your users don't need to sign in to Arcade.dev.

<Callout type="info">
Arcade's default OAuth apps can *only* be used with the Arcade user verifier.
If you are building a multi-user production app, you must obtain your own
OAuth app credentials and add them to Arcade. For example, see our docs on
[configuring Google auth in the Arcade
Dashboard](/references/auth-providers/google#access-the-arcade-dashboard).
Arcade's default OAuth apps can *only* be used with the Arcade user verifier,
which requires each end user to sign in to an Arcade account that is a member
of your project. This ties end-user authorization to project membership, which
is why the default OAuth apps are intended for development and single-tenant
use. For a multi-user production app, add your own [OAuth app
credentials](/references/auth-providers) and pair them with a [custom user
verifier](#build-a-custom-user-verifier), so your end users are verified by
your app rather than by project membership.
</Callout>

## Build a custom user verifier
Expand Down Expand Up @@ -267,8 +270,11 @@ In the [Auth > Settings section](https://api.arcade.dev/dashboard/auth/settings)

<Callout type="info">
Arcade's default OAuth apps *only* support the Arcade user verifier.
Authorization flows using Arcade's default OAuth apps will use the Arcade user
verifier even if you have a custom verifier route set up.
Authorization flows that use a default OAuth app always fall back to the Arcade
user verifier, even if you have a custom verifier route configured. Because the
Arcade user verifier requires the end user to be a signed-in member of your
project, authorizations through a default OAuth app are always gated by project
membership.
</Callout>

</Steps>
2 changes: 2 additions & 0 deletions app/en/resources/glossary/page.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -126,6 +126,8 @@ A 'tenant' is a collection of projects with unified billing details. It is the t

A 'project' is a collection of agents and tools. It is smallest unit of organization and isolation in Arcade. You can have multiple projects, and each project can have multiple agents and tools. Accounts can be members of multiple projects, and each project will have different API keys.

A project is also a trust boundary. Everyone with membership in a project, or with one of its API keys, shares access to that project's users, brokered tokens, and secrets, and can start authorization flows on behalf of its users. Only invite people you trust into a project, and only join projects you trust.

### Arcade API

The 'Arcade API' is a set of endpoints that allow you to interact with the Arcade platform. You can use the API to call tools, get tool definitions, manage user auth, and more. See the [Arcade API Reference](/references/api) for more details.
Expand Down
Loading