Skip to content
ScenarioDeck Docs

Authentication overview

Authentication overview

Section titled “Authentication overview”

ScenarioDeck separates portable application state from authentication capability.

State Card + Auth Persona requirement + local Auth Binding
  • An Auth Persona is a non-secret logical identity, such as Manager · QA.
  • An Auth Binding is approved machine-local credential or session material used only to satisfy that Persona for a supported origin.

Raw values stay outside State Capsules, run evidence, Desktop renderer state, CLI JSON, MCP responses, and logs. A Development Profile login is not the same thing as a portable Auth Binding.

Clean Session can require a Persona binding before it opens the app. ScenarioDeck fails closed when the binding is missing, expired, rejected, or scoped to the wrong origin.