Authentication

AcuGIS Cloud uses Central as its platform identity authority. Authentication support still varies by component, so integrations must follow the exact contract documented for the service they call.

Common authentication paths

Browser sessionPersonal access token

Sign in through Central. The browser receives the shared acugis_session cookie and sends it on same-origin component requests.

Create a personal access token in Central and send it where the component explicitly supports bearer authentication:

Authorization: Bearer agp_your_token

Authorization

Authentication identifies the caller; authorization determines what that caller can do. AcuGIS Cloud applies platform service permissions and, where documented, resource-level permissions such as dataset or project access.

Warning

Do not assume that every component accepting a browser session also accepts a personal access token. Check the component-specific authentication guide.

Component guides

• GeoVault authentication
• QGIS Publisher authentication
• Jasper Publisher authentication
• PostGIS Service authentication
• Central authentication
• GeoSync staging authentication checks

Security baseline

• Use TLS for every production request.
• Store tokens and credentials in a protected secret store.
• Grant only the minimum required service and resource permissions.
• Never embed personal access tokens in browser-delivered source code.
• Rotate exposed credentials and revoke tokens that are no longer needed.