> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wazoo.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> Manage tokens and security boundaries

Worlds separates management credentials from world data credentials. Treat them
as different secrets with different blast radii.

## Authentication strategies

The platform uses separate token kinds depending on the use case.

### Platform tokens

Platform tokens use the `wzp_` prefix. They authenticate management operations
against the [Wazoo Platform API](/platform/api), including user-owned World
metadata, platform tokens, world auth tokens, and usage records.

Include the token in the `Authorization` header:

```bash theme={null}
Authorization: Bearer wzp_...
```

### World tokens

World tokens use the `wzw_` prefix. They are data-plane credentials for access
to specific worlds. Agents and applications should use world tokens when they
query or update graph data. Create and revoke them from the
[Console](/console/tokens).

Store world tokens separately from platform tokens. A world token should not be
able to manage platform metadata or mint new platform credentials.

World token rotation is revoke-and-replace. The rotation operation revokes the
existing World tokens and returns one replacement token once; it must not expand
the active token count or access duration when a World is throttled.

### Admin platform tokens

Admin platform tokens are global operator credentials for private-beta support.
They are manually seeded, never created through public token endpoints, and must
use `kind = "ADMIN"`, `user_uid = NULL`, and include the `admin` scope.

Admin-only operations and quota bypasses write internal audit events. There is
no public audit log API in v1.

### Identity service

The Console is the human-facing control surface for Wazoo. Identity and team
management are separate from bearer tokens used by APIs and agents.

## Tenant isolation

The platform enforces resource boundaries at the user and World level. The
current Platform API stores management metadata separately from world graph
data.

* **Platform boundary**: Platform tokens manage metadata and credentials.
* **World boundary**: World tokens authorize data-plane access to specific
  worlds.
* **Resource boundary**: Applications should only receive the narrowest token
  needed for the task.

## Local development

Local and self-hosted deployments may use different authentication settings
while they are being developed. Do not expose a deployment publicly unless token
validation is enabled and secrets are stored outside source control.

<Warning>
  Never commit platform tokens, world tokens, database credentials, or tunnel
  credentials. Rotate any token that appears in logs, source control,
  screenshots, or shared chat transcripts.
</Warning>