Authorization guide

Resource authorization

The widget sends coordinates. Your server decides access. Load the session, then look up membership for tenantKey, resourceType, and resourceId together. A matching resource id in another tenant is a different record.

In the example, Ada, Kai, and Noor may open acme / task / task_1842. Boa may open other / task / task_1842. Boa asking for the Acme task gets not_found with The requested resource was not found. Use that same message when the id is unknown. Do not answer forbidden in a way that reveals the other tenant's row.

Mint the token only after that check. Set authorId to the session user. Set permissions from the membership row. A reader who should not reply gets ["read"]. A reply then returns 403 You do not have access to this resource. Do not copy a permission array from the browser. The widget permissions prop only hides buttons when no token is present.

The token also carries app, tnt, rtype, and rid. A token for the Acme task cannot read the other tenant's thread. Workspace and environment come from the API key. A claim that does not match the key is forbidden, not not_found.

Renew with the same checks. Stop minting when the membership row goes away. An already minted token lasts until exp (300 seconds unless you set expiresInSec). Purge makes later writes not_found or resource_frozen. Full route: Next.js.

Related: Identity and tokens · Records · API overview