Authorization

Enforce account ownership and server-only credential boundaries when multiple tenants use one application server.

Social SDK references help detect routing mistakes, but they do not replace application authorization. Before every account-scoped operation, server code must map the authenticated tenant or user to the selected account.

Required checks

1. Authenticate the application request.
2. Resolve the account from server-owned storage.
3. Confirm the tenant has the requested role for that account and operation.
4. Confirm the reference belongs to the configured backend instance and expected platform.
5. Perform the operation with credentials loaded on the server.
6. Record a redacted correlation identifier and destination outcomes for reconciliation.

Never accept an account identifier from the browser and pass it directly to a managed provider. Never place provider keys, access tokens, refresh tokens, OAuth client secrets, webhook secrets, or unrestricted native clients in browser code.

Shared accounts require an explicit membership model. Disconnecting an application record, unlinking one tenant, and revoking the upstream authorization are different actions; choose the one the user requested and describe its consequences before mutation.