Authentication and authorization model
Authentication answers "who is calling?" Authorization answers "may this caller perform this action on this resource?" TaruviBase checks both on every protected request.
Credentials#
Choose the credential for the caller your request should act as. For the exact sign-in calls, request fields, and response fields, see Get tokens and API keys.
Session token#
Use a session token for an app acting as a signed-in user. The JavaScript SDK
captures it after hosted sign-in; a custom sign-in client can obtain it through
the headless authentication API. Subsequent requests send
X-Session-Token: SESSION_TOKEN.
Sign in a user with an SDK or REST.
API key#
Use an API key for servers, scripts, CI/CD, and AI tools. It acts as the
member of your organization who created it, with that member's permissions.
Organization access skips app roles and Database row policies, so keep keys to
trusted server jobs. Requests send Authorization: Api-Key TARUVI_API_KEY.
Create an API key with REST or the Console.
JSON Web Token (JWT)#
Use a JWT access token for an integration that uses bearer authentication.
Password sign-in through the Python SDK returns a client configured with a
JWT. HTTP clients can obtain and refresh JWTs through the authentication
endpoints. Requests send Authorization: Bearer ACCESS_TOKEN; a refresh token
is used only to obtain another access token.
Protect credentials#
Keep API keys and service credentials on the server. Never put an API key in browser code, a mobile app bundle, or a public build variable. Browser and mobile apps can hold their signed-in user's session token; treat it as a credential, send it only over HTTPS, and never log it. See where the JavaScript SDK stores the session.
Authorization#
Once TaruviBase knows who is calling, it checks the caller's roles and your app's access policies for the requested action. Policies can allow or deny an action, and can limit which records the caller sees.
Reading failures#
| Status | Meaning | What to check |
|---|---|---|
401 | The credential is missing, invalid, or expired | Sign in again, or generate a new API key from the same site |
403 | The caller is known but not allowed to do this | The caller's roles and the app's access policies |
404 | The site, app, or resource was not found for this caller | TARUVI_SITE_URL, APP_SLUG, and the resource name or ID |
Error responses include a code and message that explain the failure.
Billing refusals (402, 429, 503) carry code, detail, and module
instead; see API request lifecycle.