Authentication and access

Applies to: BarcoderX Basic and Ultimate

Status: Planned. Nothing is released yet and there is nothing to download. This page explains the ideas for the API server that you run. The exact steps are written when the API is released.

Who is calling

Every call to the web API comes from something that your server can identify. These kinds of caller are planned:

Caller	How it proves who it is
Your program	Sends an API key.
A service of yours	Uses the OAuth2 client credentials flow.
A print agent	Signs a short-lived assertion with its own private key. You do not code this. See The print agent.

The API is designed so that it does not depend on one identity provider. Which providers are supported is confirmed before the first release. How a person signs in to a page that embeds the label editor is also settled later.

API keys

An API key lets a program call the API without a person.

A key looks like bx_<env>_<keyId>_<secret>. You send it in the Authorization header as a bearer token.
BarcoderX shows the whole key once, when you create it. After that it keeps only a protected fingerprint of it, so it cannot show the key again. Keep it as you would a password.
A key can have a list of permissions, an expiry date and a list of allowed IP addresses.
BarcoderX never writes a key to a log.

Permissions

Every call needs a permission called a scope.

Scope	What it allows
`templates.read`	Read templates
`templates.write`	Create and change templates
`render`	Render, export and make printer commands
`print`	Print and read print jobs
`assets.write`	Upload and delete fonts and images
`printers.manage`	Register printers, enrol agents, run maintenance
`templates.raw`	Use raw printer commands in a template
`admin`	API keys and the audit log

The scope templates.raw is never granted by default.

Other protections

All traffic uses HTTPS.
Every change that someone makes and every security event is written to an audit record.
Print jobs and data sources are encrypted while stored in your database. Print jobs are purged after a retention period.

BarcoderX is a product of P4 Software.

Was this page helpful?

Previous Web API Next Editions and licensing