Playlist · 6 videos · 43 min
Security and access control
Who may call what: access types, API users and groups, auth providers and single sign-on, roles and row ownership, the APIs Security Report that fixes what it finds, and the security features that ship with the server.
The videos of this playlist
6:051. AuthorizationAPI Authorization Without Auth Code: Access Types, API Users, Groups
Who may call which API, read which column and write what: set once, checked on every call, with no line of auth code. The support desk of Calm Home gets its own key: public, token or no access per API, an API user with its password in the secret, groups that name tables, APIs and columns, and a token that only reads.
7:252. Auth providersSign-In for Your Users: DB Token Generator, Custom Tokens and SSO
Your app has people: customers, staff, partners. Auth providers let them sign in and tell every API who is calling, without one line of login code: a DB token generator over your own table with hashed passwords, signed and refreshed tokens, a custom token generator, single sign-on with Google, Azure AD and AWS, and g.req.auth in your code.
5:153. RolesRole-Based Access and Row Ownership: Users See Only Their Own Data
Groups decide which APIs a caller may use; which rows are theirs is the other half. Give the customers of Calm Home access to their own orders and nothing else: roles as groups, a pre-hook that scopes rows with $and, rules that fail closed, g.req.auth, and a hook for one application only.
11:214. Security reportAPIs Security Report: Find Data Leaks and Fix Them in One Click
API Maker reads your whole account and tells you where a person could reach data that is not theirs, with the proof, then fixes it one click at a time. Scan Calm Home after a busy sprint: a score out of 100, how the scanner thinks, fixes for groups, system APIs, person tokens and row scoping hooks, a PDF for the review, automatic scans, and the report in Git for your AI assistants.
8:415. Code scanScan Your API Code for Leaks in 8 Languages, Fix It in One Click
The APIs Security Report of API Maker reads the code of your account in TypeScript, Python, PHP, C#, Go, Rust, Java and Kotlin, finds what it leaks on its own at its line, and fixes it in one click, in the language it is written in. On Calm Home: TLS checks off, SQL put together from the request, a key in the code, and row scoping hooks graded, rewritten and written in Python and Go.
4:296. SecuritySecure by Default: Encrypted APIs, Allowed Origins, Two-Step Sign-In
Security that ships with the server: encrypted requests and answers, Encrypt Strings for your env file, allowed origins, two-step sign in, and the known vulnerabilities of every package, with a report. The security features of API Maker, on Calm Home.