Identity and tokens

Bootstrapware does not authenticate end users. Your app asserts actor={ id, permissions }. Use session.user.id. Supplier tokens also bind supplierId from the server record. Buyer and supplier permissions cannot be mixed.

Buyer: buyer_read, buyer_edit, buyer_decide, buyer_export. Supplier: supplier_read, supplier_quote, supplier_clarify. Pass those strings on actor.permissions for the local adapter. They do not grant Hosted or BYO access. The widget does not hide buttons from a client-supplied list. The server session and author token are the authority.

Mint tokens server-side with the RFQ secret: POST /api/v1/author-tokens. Prefix bsw_rfqauth_v1.. Default TTL 300 seconds, clamped 60–86400. There is no revocation list. Stop minting when access ends. Pass renewAuthorToken so the widget can refresh before expiry.