SaFi Bank Space : Authentication and secure Authorization

Usual flow:

1. User logs in via Auth Server and user credentials and receives an access token.

2. App uses the access token and request data to send the request.

3. Cloudflare checks the token with the Auth Server’s public key. (Also, it checks the token expiration date and audience, etc.)

Our proposed flow:

1. User has a private key and signs the request data with that private key then sends the request.

2. Cloudflare checks the request by verifying the signature with the user’s public key. In order to do this, it needs to either

   1. Fetch the user’s public key from the auth server (based on a key ID in the request). Optionally the public key could be cached for subsequent access.

3. 

b. Do the check via the certificate in the request: the certificate is signed by the Auth Server’s public key.