{"slug":"platform/one-auth","title":"OneAuth Identity & Connection Architecture","section":"platform","sectionLabel":"Platform","status":"unclassified","type":"document","path":"platform/one-auth.mdx","bytes":835,"description":"Centralized credential management, token refresh, and tenant authorization.","updated":null,"source":"integratewise/Integratewise-docs-wiki","content":"\n\n## Overview\n\nOneAuth provides unified authentication for all connected services in IntegrateWise. Users authenticate once with each upstream provider (Salesforce, Zendesk, Slack, Jira, GitHub), and OneAuth manages:\n\n- **Token Lifecycle**: Automatic refresh of OAuth 2.0 access and refresh tokens.\n- **Tenant Isolation**: Secure, per-tenant encrypted credential storage using Cloudflare Secrets and AES-256-GCM.\n- **Scope Negotiation**: Fine-grained capability scoping ensuring external services can only read or write within authorized bounds.\n- **Audit Trails**: Every credential access and delegation event is logged to immutable receipts.\n"}