Granular access control for API

Feature Requests
,
1

WHAT DO YOU RECOMMEND?

Granular access control for API keys linked to spaces.

HOW COULD IT BE DONE?

It’d be nice to be able to associate an API key to a space, and that key only have CRUD access to that space.

REAL WORLD USE CASES

Security, isolation.

  • I would like to create API keys for ephemeral spaces I can run integration tests against, without the risk of affecting other spaces.
  • I would like to share API access for a particular space to friends&family, without granting CRUD access to my other private spaces.
  • I would like to grant API access to third party, less trusted apps, without granting CRUD access to all spaces
2

yap, highly needed :+1:

4

WHAT DO YOU RECOMMEND?

Have you considered adding channel-level API keys to the permission design?

HOW COULD IT BE DONE?

Channel-level API keys can be configured when using Anytype MCP, ensuring that channel-level permissions are only open to AI.

REAL WORLD USE CASES

Describe how this feature would be used, and why it should be implemented. (Demo images are very helpful)

RECOMMENDED ALTERNATIVES

not have

ADDITIONAL CONTEXT

not have

5

This report has been added to our tracker and received by our team.

7

Great idea! Moreover, it would be super to have possibility to fine-tune API Keys by:

  • spaces,
  • types,
  • read/write
  • etc

I would buy-in, but, obviously, it will be implemented when/if Anytype automation and involvement gets sophisticated enough.

8

Would it not be better to implement a more complete RBAC solution and then modify the entire API interface so that each call was also related to user credentials?