jac-sv-auth

Use a plain def or def:priv declaration, which both require a JWT and run on the caller's own root. Only def:pub skips authentication, so secure-by-default is the plain declaration.

def:pub allows anonymous callers on a shared guest graph, while def:priv and plain def require a JWT and run per-user. def:protect has identical auth to def:priv; its three-way gradient controls source visibility, not authentication.

POST to /user/register with an identities array and credential object, then POST to /user/login with a single identity and credential to receive a token. Registration returns no token, so login is a separate required call.

A 401 means the endpoint is not def:pub and no valid Bearer token was sent. Do not fix it by switching to def:pub, since that changes which graph the endpoint runs on, not just who may call it.

Yes, Jac has built-in admin, system, and user roles stored on the user and carried in JWT claims. Set roles via the admin API or admin portal; app-domain roles use a role field on a node checked inside authenticated endpoints.

The default signing secret is publicly known, letting anyone forge tokens for any user. Set a real secret via the scale.jwt config or JWT_SECRET environment variable; note that tokens cannot be revoked before expiry.