@Teymour there is an auth component at query-service. After a user provides correct credentials, they receive a bearer token which is stored at frontend and passed to every request to backend. Every token has an expiry period, probably 30 mins after which a new token is provided using refreshToken api