Auth Service

Purpose

Identity and access management — user registration, authentication, JWT issuance, and session management.

Responsibilities

• User registration and login
• JWT access/refresh token issuance
• Password hashing (bcrypt)
• Token refresh and revocation
• Role assignment

Non-Responsibilities

• Customer profile data (Customer Service)
• KYC verification (Customer Service)
• Authorization decisions on resources (downstream services)

APIs

Method	Endpoint	Auth	Description
POST	/api/v1/auth/register	Public	Register new user
POST	/api/v1/auth/login	Public	Authenticate, return JWT
POST	/api/v1/auth/refresh	Refresh token	Issue new access token
POST	/api/v1/auth/logout	Bearer	Revoke refresh token
GET	/api/v1/auth/me	Bearer	Current user info

Database

Table	Key Columns	Description
users	id, email, password_hash, status	User accounts
roles	id, name	Role definitions
user_roles	user_id, role_id	Role assignments
refresh_tokens	id, user_id, token_hash, expires_at	Active sessions

Kafka

Produces: AuditEventCreated Consumes: None Partition key: user_id

Dependencies

Sync: Customer Service (link user to customer) Async: Audit events

Failure Handling

• DB down → 503, no auth possible
• Brute force → account lockout after N failures
• Token leak → refresh token rotation

Scaling

Stateless compute, horizontal scaling. DB connection pool sizing critical.

Security

bcrypt password hashing. JWT signed with RS256. Rate limit login endpoint.

Observability

Metrics: auth_login_total, auth_login_failures, auth_token_issued. Traces: login flow.