Bearer token ([JWT: RFC 7519](https://tools.ietf.org/html/rfc7519)) issued by
the identity provider (IdP) to attest a user's identity.

| JSON representation ||
|---|---|
| ``` { "aud": string, "email": string, "exp": string, "iat": string, "iss": string, "google_email": string, ... } ``` |

| Fields ||
|---|---|
| `aud` | `string` The audience, as identified by the IdP. Should be checked against the local configuration. |
| `email` | `string (UTF-8)` The user's email address. |
| `exp` | `string` Expiration time. |
| `iat` | `string` Issuance time. |
| `iss` | `string` The token issuer. Should be validated against the trusted set of authentication issuers. |
| `google_email` | `string` An optional claim, to be used when the email claim in this JWT is different from the user's Google Workspace email ID. This claim carries the user's Google Workspace email identity. |
| `...` | Your Key Access Control List Service (KACLS) is free to use any other claims (location, custom claim, etc) to evaluate the perimeter. |

## KACLS authentication token for `delegate`

The authentication token contains a JSON Web Token (JWT) ([JWT: RFC
7519](https://tools.ietf.org/html/rfc7519)) that is a bearer authentication token.

Sometimes a user is not able to authenticate on a client directly. In these
cases the user can delegate their access to a specific resource to that client.
This is achieved through issuing a new delegated authentication token that
limits the scope of the original authentication token.

The delegated authentication token is similar to the ordinary authentication
token with one additional claim:

| claim ||
|---|---|
| `delegated_to` | `string` An identifier for the entity to delegate authentication to. |

The `resource_name` claim in the authentication token is, in a delegation
context, used for identifying the object encrypted by the Data Encryption Key
(DEK) for which the delegation is valid.

The token is issued by the Key Access Control List Service (KACLS) using the
`Delegate` call. It may be either self-signed JWTs that KACLS is able to
validate, or KACLS may use any other IdP to do that, through a trusted call.

In order for the delegated authentication token to be considered valid, a
delegated authorization token must be provided for the same operation. The
delegated authorization token is similar to the ordinary authorization token,
but contains the additional claim `delegated_to`. The values of the
`delegated_to` and `resource_name` claims must match the values in the
delegated authentication token.

We recommend that you set a lifetime value of 15 minutes for the delegated
authentication tokens to avoid potential reuse in case of leakage.

| JSON representation ||
|---|---|
| ``` { "email": string, "iss": string, "aud": string, "exp": string, "iat": string, "google_email": string, "delegated_to": string, "resource_name": string ... } ``` |

| Fields ||
|---|---|
| `email` | `string (UTF-8)` The user's UTF-8 formatted email address. |
| `iss` | `string` The token issuer, should be validated against the trusted set of authentication issuers. |
| `aud` | `string` The audience, as identified by the IdP. Should be checked against the local configuration. |
| `exp` | `string` Expiration time, should be checked. |
| `iat` | `string` Issuance time, should be checked. |
| `delegated_to` | `string` An identifier for the entity to delegate authentication to. |
| `resource_name` | `string` An identifier for the object encrypted by the DEK, for which the delegation is valid. |
| `...` | The KACLS is free to use any other claims (location, custom claim, etc...) to evaluate the perimeter. |

## KACLS authentication token for `PrivilegedUnwrap`

Bearer token ([JWT: RFC 7519](https://tools.ietf.org/html/rfc7519)) issued by the identity provider (IdP)
to attest a user's identity.

This is only used on `PrivilegedUnwrap`. During `PrivilegedUnwrap`, if a KACLS
JWT is used in place of an IDP authentication token, the recipient KACLS must
first fetch the JWKS of the issuer, then verify the token signature, before
checking the claims.

| JSON representation ||
|---|---|
| ``` { "aud": string, "exp": string, "iat": string, "iss": string, "kacls_url": string, "resource_name": string ... } ``` |

| Fields ||
|---|---|
| `aud` | `string` The audience, as identified by the IdP. For Google Drive client-side encryption (CSE) `PrivilegedUnwrap` operations, this should be `kacls-migration`. |
| `exp` | `string` Expiration time. |
| `iat` | `string` Issuance time. |
| `iss` | `string` The token issuer. Should be validated against the trusted set of authentication issuers. Must match the `KACLS_URL` of the requesting KACLS. The public key set of the issuer can be found at `<iss>/certs`. |
| `kacls_url` | `string` URL of current KACLS, that the data is being decrypted on. |
| `resource_name` | `string` An identifier for the object encrypted by the DEK. Maximum size: 128 bytes. |
| `...` | Your Key Access Control List Service (KACLS) is free to use any other claims (location, custom claim, etc) to evaluate the perimeter. |