Identity and tokens

Bootstrapware does not authenticate end users. Your app asserts actor={ id, permissions }. Use session.user.id. Supplier tokens also bind supplierId from the server record. Buyer and supplier permissions cannot be mixed.

Buyer: buyer_read, buyer_edit, buyer_decide, buyer_export. Supplier: supplier_read, supplier_quote, supplier_clarify. Pass those strings on actor.permissions for the local adapter. They do not grant Hosted or BYO access. The widget does not hide buttons from a client-supplied list. The server session and author token are the authority.

Mint tokens server-side with the RFQ secret: POST /api/v1/author-tokens. Prefix bsw_rfqauth_v1.. Default TTL 300 seconds, clamped 60 to 86400. There is no revocation list. Stop minting when access ends. Pass renewAuthorToken so the widget can refresh before expiry. The widget calls it when unverified exp is under 60 seconds away, and again when the server reports an expired author token, at most once every 30 seconds.