Embed security model
The partner backend is the identity authority. Dataira never asks the browser to prove who the end user is with a reusable server credential.
The public SDK demo follows this model: its API key stays on the demo server and the browser receives only a short-lived token for the read-only sample datasource.
Credential chain
- Your backend authenticates the end user.
- It uses an API key scoped to one Project and Environment.
- It requests a short-lived token for an end-user organization, end user, datasource, and row scope.
- The browser uses that token with
@dataira/reactor@dataira/client. - The frontend requests a fresh token from your backend when needed.
Scope layers
| Layer | Fixed by |
|---|---|
| Partner / Tenant | API key ownership; emitted as tenant_id |
| Project and Environment | API key scope |
| End-user organization and user | Registered membership and token claims |
| Datasource | Token claim and access policy |
| Data slice | scopeColumn and scopeValue token claims |
Collection, preference, conversation, metric, and dashboard operations derive their full Partner/Environment/customer-org/user scope from the token. Their APIs do not accept an arbitrary identity override.
Partner responsibilities
- Store API keys only in a backend secret manager.
- Authenticate every token endpoint request.
- Derive the end-user and row scope from the authenticated session, not browser input that has not been validated.
- Create separate Environment keys where staging and production must not share credentials, data, or user assets.
- Revoke and rotate keys according to your security policy.
The Node SDK is a convenience layer, not a trust requirement. Any backend can call the token API over HTTPS and keep its own database and identity system.