hey do you guys distinguish access key of users/keys somehow besides the prefix in the sid?

Hi, I'm Descope's AI assistant. I've put together an initial response below based on your question. A member of the support team will take over and follow up shortly. Key Distinguishing Features: Access keys are distinct from users in several ways: • Access Key Properties: ◦ Have a

clientId

field that users don't have. ◦ Include

keyTenants

array for tenant associations. ◦ Have

permittedIps

for IP restrictions. ◦ Use

boundUserId

to optionally associate with a user. • JWT Token Differences: ◦ Access keys can include custom claims in the

nsec

field when exchanged for JWTs. ◦ Access key JWTs can use custom JWT templates with claims inserted directly into the payload. • Management Differences: ◦ Access keys have their own lifecycle (activate/deactivate/delete). ◦ Can be managed via dedicated Access Key Management SDK functions. ◦ Have expiration settings (including "Never" option). • Usage Context: ◦ Access keys are specifically for machine-to-machine authentication. ◦ Users authenticate through frontend flows, while access keys are exchanged for JWTs programmatically. The

clientId

field is probably the clearest programmatic way to identify an access key versus a regular user token.