Management authentication

OAuth access tokens with the REST audience. Serving keys and setup tokens are rejected.

Caller identity and workspaces (grant ∩ membership).

Authorization: Bearer <management access token>
Audience must be knobase.management.rest. MCP tokens are rejected.
kb_… and kb_setup_… return TOKEN_CLASS_MISMATCH.
JWT workspace_ids is a hint. Runtime loads grant_id → active oauth_workspace_grant → membership + role + scopes.
Writes require Idempotency-Key. PATCH requires If-Match or version.