Authentication
Debbie gives your developers multiple authentication options so they can choose the best approach for their integration.
How Debbie Handles Authentication
Debbie is built on Laravel Passport, providing a full OAuth 2.0 authorization server out of the box. It supports multiple authentication methods so your developers can choose the right approach for their use case — from server-to-server communication to user-facing web applications.
API Keys
Simple key-based authentication for server-side integrations, CLI tools, and scripts.
OAuth 2.0
Industry-standard authorization framework for web, mobile, and desktop applications.
Access Tokens
Short-lived tokens issued after authentication, used to authorize API requests.
Debbie as an Authorization Server
Debbie is not your Resource Server — it is the Authorization Server that controls access to your APIs. When a developer's application needs access to a user's data, Debbie orchestrates the entire OAuth flow: authentication, consent, token issuance, and token validation.
Your Resource Servers validate tokens against Debbie's public keys or via token introspection, without needing to manage OAuth logic themselves.
💡 For Platform Administrators
As an administrator, you configure which authentication methods are available, define OAuth scopes, set token lifetimes, and enforce PKCE requirements — all from Debbie's admin interface.