Tokens

Keystone issues scoped bearer credentials clients place in headers to authorize API calls until expiry or revocation. Services validate tokens centrally and honor role assignments embedded in payloads. Short lifetimes plus refresh flows limit stolen-token damage.