API Authorization Without Auth Code: Access Types, API Users, Groups

Intro

0:00 Who may call which API, read which column, and write what : set once, checked on every call, with no line of auth code. In this video, the support desk of Calm Home gets its own key.

Authorization, the usual way

0:13 Authorization usually means middleware written route by route, role checks spread through the handlers, a new endpoint left open by mistake, and a copy of every model to hide a column. With API Maker, every API has an access type, each application is an API user with a token, groups name the tables, APIs and columns it may use, and all of it is checked before any code runs. In this video : access types, the two checks of a call, a group, columns, an API user and its token, a call refused, then allowed, and a token that only reads.

Access types

0:50 Every API has one of three access types. Public : anyone may call it, no token. Token, the default : the caller needs a token, and a group that grants this API. No access : nothing from outside, only the admin panel and your own code. It is set on an API, a table or a database : the closest one that says it wins. Instance API, MongoDB, catalog, and its categories.

1:19 Add Collection Settings : TOKEN_ACCESS, the default. IS_PUBLIC, and Save. From outside, with no token : the eight categories. The customers are still on token access : four hundred and one, the header x-am-authorization is not valid. Now NO_ACCESS, and Save. From outside : four hundred and one, you are not authorized to access this API. The admin panel and the code inside API Maker still reach it : a table for your own code only.

The two checks of a call

1:53 A call on token access passes two checks. First the token, in x-am-authorization : it names an API user, an application. Then its groups : one of them must grant this API, by instance, database, table and API. And the columns the group lists are the only ones it reads.

A group

2:15 Security, API Group Permissions : Default grants everything. Add New, Support team, Save Group. Selected, it shows what it may call : Instance APIs first. The instance postgres, the database crm, its customers and its support tickets. Two tables, no more : a table added tomorrow stays closed to this group. Each table lists its APIs. Get all on the customers, Get all on the tickets, and Get by id.

2:46 No save, no update, no remove : this group reads.

Columns

2:51 Schema Fields : the columns of each table. The id, first name, last name, the city, status, and loyalty tier, each ticked R, for read. Email and phone are left out. Save group settings.

An API user and its token

3:06 API User Permissions : one API user per application. Add New, Support Desk, username support_desk. Its password is read from a key of the default secret : it never goes to Git. Save User. For now, it is in no group. The application asks the token API for a token, with its username and password : valid three days. Inside, its username, the moment of its last password change and an expiry.

3:36 A new password ends every older token. With it, a customer, without email and phone, and the orders of MySQL : four hundred and three.

Refused, then allowed

3:45 The same in API Testing. API Testing, postgres, crm, customers, Get all. x-am-authorization : Support Desk. Send : four hundred and three. Support Desk is not having access to this API : it is in no group yet. API User Permissions, Support Desk, the group Support team, Save. Back in API Testing, as Support Desk, Send : the customers, with their names, city, status and tier. No email, no phone : the columns of the group.

A token that only reads

4:27 Now a write : Save single-multiple, as Support Desk, in the body, a new customer. Four hundred and three : the group only reads. A read-only token is just that, an API user in groups that only read.

Good to know

4:43 Calls made from code with g.sys.db do not pass these checks : your code is trusted, the outside is not. Column rules follow the groups of the API user, the application. Each API user can publish Swagger docs of exactly the APIs it may call. Groups, API users and settings are files in Git, reviewed like code.

Built on standards

5:07 A group opens only what it names : a new table or API stays closed to it. No check lives in the code, so code written by a person or an AI assistant can not forget one. And one place answers who may call what.

Recap

5:23 To sum up. Public, token or no access, per API, table or database. An API user per application, its password in the secret. Groups that name tables, APIs and columns. Refused until granted, and read-only by design. Next : auth providers, the tokens of the people who use your apps. API Maker. Build faster, spend smarter, deliver better.