Authentication and Data Access Flow Diagram

OAuth + PKCE Connection

The partner authenticates the user and issues an authorization code
Toqan exchanges the code for tokens using the PKCE code_verifier
The access_token (JWT) authenticates every subsequent call

JWT Authorization

Every MCP call validates signature, iss, aud, and exp
The Auth-Service confirms the subject's stores and permissions
Permissions are cached with a short TTL

Data Access

DataBridge runs queries filtered by authorized store_ids
The MCP never queries stores outside the subject's scope
Toqan returns the response to the user