What problem does it solve? Services acting as BYOT relying parties must verify that every team-scoped request carries a valid DIDKey signature plus an AWID team certificate, and getting the envelope verification wrong creates replay, forgery, and auth-bypass vulnerabilities. ## Core Features & Use Cases - Ten-step verification procedure: A precise implementation order for parsing the DIDKey auth header, decoding the team certificate, binding timestamp/body/method/path/audience, verifying the Ed25519 signature, resolving AWID team facts, and checking revocation. - Envelope contract specification: Defines the four required headers (Authorization, X-AWEB-Timestamp, X-AWID-Team-Certificate, X-AWEB-Signed-Payload) and the canonical JSON v2 signed-payload format. - Anti-pattern catalog: Documents eight concrete failure modes such as verifying a cert against its own team key, trusting certs when AWID is down, or using router-normalized paths. - Use Case: When porting folio's auth.py verifier to a new FastAPI service, follow the ten steps and keep tests/test_auth_v2_envelope.py green to guarantee byte-for-byte interop with aw id request --team-auth. ## Quick Start Ask the AI to implement the v2 team-auth envelope verifier in your service by porting src/folio/auth.py following the ten verification steps in this skill.
