ashb commented on code in PR #60108: URL: https://github.com/apache/airflow/pull/60108#discussion_r3131687862
########## airflow-core/docs/security/jwt_token_authentication.rst: ########## @@ -201,16 +201,26 @@ Token structure (Execution API) Token scopes (Execution API) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ -The Execution API defines two token scopes: +The Execution API defines two token scopes with different lifetimes: **workload** - A restricted scope accepted only on endpoints that explicitly opt in via - ``Security(require_auth, scopes=["token:workload"])``. Used for endpoints that - manage task state transitions. + A token embedded in the workload JSON payload when the Scheduler + dispatches a task. This scope is accepted only on endpoints that explicitly opt in + via ``Security(require_auth, scopes=["token:workload"])``. The longer lifetime Review Comment: I know I had this before, but on seeing this now I think this is an implementation detail we should remove from the public docs -- this is for people to know how Airflow auth works/operates, not how to develope Airflow. The rest is good. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
