## :dart: Goal Real **authentication** for the Artifact Registry service for the Closed Beta — replacing the S08 bootstrap-token stub with local, stateless validation of incoming token-exchange JWTs. Direction is locked by **[ADR-020: Authentication Flow](https://handbook.gitlab.com/handbook/engineering/architecture/design-documents/artifact_registry/decisions/020_authentication_flow/)** (status: Proposed; merged to handbook `main` 2026-06-11). It consumes the authentication requirements of the Auth Platform interface agreement: **R1 (token exchange)**, **R2 (token validation)**, **R3 (token payload)**. Per ADR-020: a client obtains a short-lived RS256 JWT from its GitLab instance via `POST /api/v4/token_exchange`; the Artifact Registry **validates it locally** against its pre-configured trusted issuer's public keys (JWKS, synced out of band), never sees long-lived client credentials, and **does not call the GitLab instance during request processing**. ## :compass: Scope (Closed Beta) ADR-020's first iteration targets **same-boundary topologies** (`.com ↔ .com`, `SM ↔ SM`, `Dedicated ↔ Dedicated`), where a single instance has a single trust anchor. The cross-boundary topology (multiple Self-Managed instances sharing one SaaS Artifact Registry) is a follow-up iteration. The Rails-side issuance path (`POST /api/v4/token_exchange`, R1) is **already shipped** ([!236798](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/236798) + [!238351](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/238351) + [!238718](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/238718)), so it is **not** part of this epic. What remains is the **Artifact Registry side**: syncing the signing keys and validating tokens locally (R2). ## :open_book: Notes - Tokens are signed with the **Cloud Connector v1 key** for same-boundary flows; `gitlab_instance_uid` is omitted (single trust anchor). - Validation is against a **pre-configured trusted issuer's keys**; the `iss` claim is informational/logged only. The validator pins the signature algorithm and rejects a wrong `aud` or a past `exp`. - **Deploy tokens are excluded** in iteration 1 (a deploy token is not a `User` principal) — follow-up [gitlab-org/gitlab#601332](https://gitlab.com/gitlab-org/gitlab/-/work_items/601332). Parent: [Artifact Registry Closed Beta](https://gitlab.com/groups/gitlab-org/-/epics/21052).