MyServers Permission

[noah]

hi.

customers require access control for API Keys.
A feature is needed to restrict the range of APIs that can be called on an API Key basis.
In MyServers, there is no way to handle this other than using IP addresses.

[Paul Winterhalder]

Hi @noah,

I agree that this would be a good feature.

I've been doing some thinking on it...

What if we could restrict an S2S server to only being able to call a specific set of scripts? That way you would be in full control as to the scope of the API that you are making available.

Would that work for your use case?

Paul.

[noah]

hi. @Paul-Winterhalder
yes, permissions to call specific scripts and access control for Services and Operations regarding the generally provided functions are required.
For example, there may be management tools that call specific scripts and use certain functions (CloudData...),
and there may be administrators who only manage items.
If possible, each API Key should be a function with permissions tailored to the situation.

Let me give you an example. A company utilizes a mix of office and remote work. While the internal network can be protected to some extent by IP ranges, it is difficult to identify specific IPs because multiple operators work from home. Therefore, it is currently somewhat difficult to handle this situation using only IPs.

[noah]

hi. @paul-winterhalder @johnh

Recently, security-related issues have become an ongoing concern within our company. In this era of AI, we are facing persistent security challenges, such as intrusions into our internal network and the theft of keys belonging to remote workers.
I believe this is a matter that can no longer be deferred.

API keys must be assigned specific permission scopes.

While the current IP range configuration may have been designed with only servers in mind, it becomes highly impractical when developing internal web admin tools that rely on server-to-server (S2S) keys—as it would require registering the individual IP addresses of every staff member, which is simply not a viable solution.

Please take this issue into consideration.