Authentication

Jeden does not embed provider credentials into prompts or duplicate provider login logic. Authentication is delegated to the configured entitlement owner.

Inspect status

/settings
/login
/login <provider>

Status views report provider and entitlement state in redacted form. They do not print tokens, cookies, or stored credentials.

Lifecycle

/login <provider>
/refresh <provider>
/logout <provider>

The entitlement router owns whether a provider supports native login, a browser handoff, a device flow, or operator-managed credentials.

Operator configuration

ENTITLEMENTS_ROUTER_BIN overrides the executable used by authentication operations. The binary boundary allows Jeden to inspect and request actions without taking ownership of secret storage.