Overview
The hosted authentication and authorization service of the Febasi platform — identity, sessions, RBAC, audit, configurable per tenant.
Febasi Auth is the hosted identity service that powers every product in the Febasi platform. It owns users, sessions, roles, permissions, JWT signing, and the service-to-service credentials your integration uses.
It is multi-tenant by design and live at:
https://auth.febasi.com.br/api/v1You do not host or provision the service yourself. Each tenant is created and managed through an Authentication project inside Eved — the wizard there configures your password policy, token lifetimes, session limits, and hands you back a fully wired dashboard.
How you get here
What Auth gives you
Multi-tenant identity
Every user, role, permission, and audit row is scoped to a tenant. Cross-tenant access is impossible by design.
Login & sessions
Email, username, or CPF/CNPJ + password login. Access tokens with refresh-token rotation, atomic session limits, and admin revocation.
Roles & permissions
Hierarchical RBAC with scope:action permissions. Role-based and direct grants, with expiration dates on both.
Integrations
Service-to-service via Client Keys — scoped permissions, optional per-key origin and IP allowlists, full usage logs.
Per-tenant security
Your own JWT signing secret with safe rotation, tenant-scoped CORS and source-IP allowlist overlays.
Audit & metrics
Every meaningful event is logged. Built-in login + security metrics catch brute-force patterns out of the box.
Built-in conventions
-
Versioned URLs. Every endpoint lives under
/api/v1/.... Breaking changes ship as/api/v2/..., never as a silent change to v1. -
Standard JSON envelope. Every response — success or error — wraps its payload the same way:
{ "success": true, "data": { "..." : "..." } } { "success": false, "error": "Human message", "code": "MACHINE_CODE" } -
One identifier from any of three. Users authenticate with
email,username, orcpf_cnpj— whichever your tenant enabled. -
Bcrypt 12 rounds for password hashing (OWASP 2025 baseline).
-
HS256 JWTs signed with your tenant's secret when configured, safely rotated.
Where to dive in
Get started in 5 minutes
Tenant + user prerequisites, then a login, an access token, and a /me call.
Registration
The three paths to create users — Eved dashboard, in-product admin JWT, server-side proxy.
Endpoints reference
The complete tenant-facing API surface, grouped by module, with required permissions.
Production
| Surface | URL |
|---|---|
| API base | https://auth.febasi.com.br/api/v1 |
| Interactive reference | https://auth.febasi.com.br/docs |
| OpenAPI spec (JSON) | https://auth.febasi.com.br/docs/openapi.json |
| OpenAPI spec (YAML) | https://auth.febasi.com.br/docs/openapi.yaml |
| Tenant dashboard | https://app.febasi.com.br (Eved) |
The reference at /docs is rendered by Scalar: built-in request playground, code samples in your language of choice (curl, fetch, Python, Go, Rust, and more), and ⌘K search. The same OpenAPI 3.1 specification powers the Postman collection shipped with the service.