Skip to main content

Users and authentication security and limits

TaruviBase has two kinds of access: organization access, which lets your team manage sites in Console, and site access, which lets people use your app.

Scope and mutations​

Cloud users, organization memberships, invitations, and site-access synchronization are Console-only. Site-user mutation endpoints currently enforce authentication rather than a dedicated admin permission. Verify the caller, hostname, and selected site for every sensitive operation.

User deletion is a soft delete. A user cannot delete itself, and a caller that is not a superuser cannot delete a superuser; follow the site user deletion controls. Deleted users can't be restored through the Console or API; if you need a user restored, contact TaruviBase support.

API tokens​

API tokens inherit the user's current permissions and have no independent per-token scope. Treat plaintext token output as one-time secret material and prefer a finite expiry. Revoking a token returns 200 OK.

If one-time plaintext is lost, create a replacement, store it immediately, update and test consumers, then revoke the old token when possible. See API tokens.

Hosted flow and SSO​

Hosted sign-up is controlled by security.signup-enabled. Two-factor authentication isn't available yet; the Enable 2FA security setting currently has no effect. OpenID Connect provider records are shared rather than site-isolated; deletion is blocked while connected users exist.

Use hosted sign-in for session recovery and OpenID Connect SSO for shared-provider deletion controls.

Good practices​

  • Create a site user for each person who uses your application; a cloud user or organization membership doesn't replace one.
  • Keep credentials, private identity data, and secrets out of URLs, screenshots, and logs.
  • A token always acts with its user's current permissions, so changing a user's access changes what their tokens can do.