Security & access
Roles, scopes, and tenancy
Three authorization layers and the credentials that cross them.
Repository-validated operator guidance View source ↗
#Three layers
| Layer | Rule |
|---|---|
| Admin scopes | Admin routes need requireRole admin plus an exact scope like databases.write; a bare admin session without scopes is rejected. |
| Per-server RBAC | Owners pass; subusers need the exact permission from the permission catalog (console, files, databases, schedules, backups, allocations, startup, mounts, settings, activity). |
| Org tenancy | Resolved from the URL and resource graph — never a header. Members read; owners and admins manage; scoped API keys are denied tenancy writes entirely. |
FLOW
Authorization decision
01Request arriveswho
02Session checktier
03Role checkexact scope
04Scope checkenforce
05Allow or deny
#Credentials that cross layers
| Credential | Powers |
|---|---|
| API keys | 48-byte hex with prefix lookup, expiry, and IP allowlists. Admins may hold any of ~60 admin scopes; non-admins only servers.read, write, delete. |
| OAuth clients | Client-credentials flow only, HTTP Basic, scope server (bound to one server) or account. |
| Social login | Discord, Steam, Authentik via short-lived state and a single-use exchange code — no tokens in URLs. |
| mTLS | Optional node identity by certificate URI/DNS/CN with revocation checked fail-closed. |
| WebAuthn | Hardware keys satisfy the 2FA policy where enabled. |
#Org model
Organizations own projects, projects own environments, servers attach to orgs. Roles rank owner, admin, member, viewer. There is no super-admin tier in the authorization code — a rootAdmin field is serialized but never checked, so do not document or rely on it as a privilege level.
Deny by default
Unknown roles, missing stores, database errors, and unresolvable targets all deny. Custom roles match allow/deny path rules with deny winning. When in doubt the panel says no.