Macaroon

A macaroon is an authorization credential that can be restricted by adding caveats, such as a permitted action or expiry condition. Its construction uses chained message authentication so restrictions can be added without possessing the issuing service’s secret.

Verification must validate the signature chain and satisfy the relevant caveats. Some designs use additional discharge credentials for third-party conditions. The format provides a delegation mechanism, not automatic enforcement of restrictions by an unaware service.