Client Device
198.51.100.42
Bearer Token:None
HMAC App/Key:Unprovisioned
Signature A:None
> POST /oauth/token (alice / ***)
Identity Provider (IdP)
RS256 / KMS
Auth Check:Verifying alice
Key Registry:RS256 2048-bit
> Issues short-lived JWTs & provisions HMAC secrets
WAF / API Gateway
EDGE GUARD
Token / HMAC B:Standby
Nonce Cache:Window 300s OK
Gate Decision:Listening :443
> Enforces JWT expiry, HMAC A==B & anti-replay nonces
Protected API Service
mTLS UPSTREAM
OAuth Scope:read:profile
DB Transaction:Idle
> Shielded behind API Gateway perimeter