Implementation GuidesServer-side and APIs

API requirements and best practices

What every API behind CSI Auth is expected to do
Report issue

Covers the baseline every API is expected to meet regardless of language: validating tokens on every request, enforcing scopes per endpoint, and not trusting claims it hasn’t verified itself.