Use cases

API authorization

Per-request decisions for your own API, with limits your customers can hold.

The problem

API keys are all-or-nothing and long-lived. Scoping them properly means building an authorization system, which is not the product you set out to build.

Without Bengar

• Scopes invented per endpoint and enforced inconsistently.
• Rate limits standing in for authorization.
• No way for a customer to delegate a subset of their access.

With Bengar

• One call that returns a decision with a reason.
• Permits customers can hold, delegate and revoke themselves.
• Policy that changes without reissuing anything.

The flow

1. Your API receives a request carrying a permit.
2. It calls `/v1/authorize` with the action and the resource.
3. It proceeds only on ALLOW, and returns the reason otherwise.

Components used

Permits · Policy · Gateway · Audit

Example

app.post("/orders", async (req, res) => {
  const decision = await bengar.authorize({
    agent:    req.caller.did,
    permit:   req.header("x-bengar-permit")!,
    action:   "create_order",
    resource: `resource://api/orders/${req.body.accountId}`,
  });

  if (decision.decision !== "ALLOW") {
    return res.status(403).json({ error: decision.reason_code });
  }
  // …
});

Security properties

Try it →