Thunder Authentication

End-user identity is delegated to Thunder, the platform's Identity Provider, which the API gateway is wired to as its external IDP. That gives every project with sign-in two halves reading one claim set:

• The SPA signs the user in with OIDC Authorization Code + PKCE and reads their claims from the ID token (user.profile.groups).
• The protected backend never sees a token: the gateway validates it and injects the SAME claims as headers (X-User-Groups). See api-management for the gateway's side of that contract.

It is one claim set, so the two sides must resolve a caller's role identically.

The OAuth client itself is platform-owned: you never create, compute, or hardcode any part of it.