Port: 9002 (private) - Internal use only, not exposed publicly.
Polymorphic credential validation supporting both JWT tokens and API keys. Called by API gateway to validate incoming requests before proxying.
For JWT tokens, validates against Auth0 and returns user information. For API keys, validates the key hash and returns associated user/account info.
When validating for write operations (POST, PUT, PATCH, DELETE), unverified users will receive a 403 Forbidden response.
JWT token from Auth0
Original HTTP method from upstream request (used by gateway). If method is POST/PUT/PATCH/DELETE and user is unverified, request is rejected.
GET, POST, PUT, PATCH, DELETE