This page View Markdown Open in ChatGPT Open in Claude

Security features¶

Tokens and groups decide who can call which API, table and column. The features below add more layers on top of them.

In short

The security report finds where a person could reach rows that are not theirs, and fixes most of it in one click.
Allowed origins and two-factor sign-in guard the browser side and the admin panel.
Encrypted payloads add a layer when TLS ends at a proxy you do not control. They never replace HTTPS.

Secure by Default: Encrypted APIs, Allowed Origins, Two-Step Sign-In10 chapters and the transcript

APIs Security Report & Actions¶

Security › APIs Security Report & Actions scans the account and shows where a person could read or change rows that are not theirs: collections no pre-hook limits to the caller, groups that reach too far, weak auth providers and public APIs.
A leak comes with the request that proves it, and many findings come with an action that fixes them in one click, such as a row scoping pre-hook. Findings you accept are skipped with a reason.
The report gets a score out of 100. It goes to the repository as src/api_security_report/ when you commit, where an AI assistant working on the project can read it.
Learn more APIs Security Report & Actions.

Encrypted request payloads¶

Send the header x-am-encrypted-payload: true and put the encrypted payload in dataEncFE.
dataEncFE is { data, createdAt } encrypted with encryptionAlgorithmFETransfer and secretFETransfer of the secret. Share that key with your frontend or mobile app.
What it protects, and what it does not : anyone who opens your app or reads its JavaScript can find that key, so it is no secret from your users. The format is the one of CryptoJS (U2FsdGVkX1…), whose key derivation is based on MD5. Use it as an extra layer when TLS ends at a proxy or a CDN you do not control, never in place of HTTPS, tokens and groups.
A payload older than feTransferDataValidityInSeconds is refused, so a captured request can not be replayed later.
Turn on acceptOnlyEncryptedData and plain bodies and query strings are refused. It can be set for a database, a table, an API, and for custom and system APIs.

POST /api/schema/admin/mongodb/shop/orders/save-single-or-multiple
x-am-authorization: <API user token>
x-am-encrypted-payload: true

{ "dataEncFE": "U2FsdGVkX1+q3n..." }

common: <T.ISecretTypeCommon>{
    encryptionAlgorithmFETransfer: 'AES',
    secretFETransfer: '...',
    feTransferDataValidityInSeconds: 300, // older payloads are refused
},

Encrypted responses¶

The header x-am-get-encrypted-data gets the answer encrypted in encryptedData, with the same transfer key. It protects as much as encrypted payloads do : see above.

The channel of the local client¶

The local client connects inside the encrypted channel of the admin panel, and proves the sync token without sending it ; the server proves it in its turn. Nothing it says can be read or replayed, and nobody can pass for the server.
It writes inside its own folder only, whatever it is sent. An address which gives too many wrong sync tokens is refused for 15 minutes.
The bar of the admin panel shows every local client of the account, with its address ; a new sync token disconnects all of them.
Learn more Developer tools.

Allowed origins¶

Add the web origins of your apps in the tab Allowed Origins of the Sandbox Settings page.
When the list has entries, a browser request from any other origin is refused with 403 before anything runs.
An empty list allows every origin.

The root user can ask for a second factor when people sign in to the admin panel: a code from an authenticator app, a code sent by email, or both.
Recovery codes are shown once and stored hashed.
The root user also sets the code length and expiry, the attempts and the resend delay.
Email codes go out through the server of the root user in Outgoing Email (SMTP).
The second factor of each person stays on the server : it is never written to Git, and a pull never changes it.

Vulnerabilities¶

Security → Vulnerabilities audits two scopes for known vulnerabilities : a summary by severity (critical, high, moderate…), then each package with its range, how it arrives (the chains from a package asked for by name), the version which clears it and whether that version was checked, and the details of every advisory.

Sandbox : the packages of your sandboxes, of every language your code is written in. A chip per language shows how many of its packages are vulnerable and narrows the list to them ; every package says its language, and its link opens the registry it comes from.

Language	Registry	What is audited	Advisories
TypeScript / JavaScript	npm	The packages of Sandbox settings, resolved from the registry as an install would resolve them today, with everything they bring	npm
Python	PyPI	What the image of its sandboxes has installed : the packages of Sandbox settings, what they brought, and the tools of the image	OSV
PHP	Packagist	The same, from `composer.lock` of the image	OSV
C#	NuGet	The same, from what NuGet restored in the image	OSV
Go	Go modules	The same, from the modules of the build of the image	OSV
Rust	crates.io	The same, from `Cargo.lock` of the image (with the crates of the runner of API Maker)	OSV (RustSec)
Java, Kotlin	Maven Central	The same, from the tree Maven resolved in the image : the packages asked for and what each brought	OSV

The image says what runs. For Python, PHP, C#, Go, Rust, Java and Kotlin the audit reads the packages in the image of the sandboxes : the version which is installed, not the one written in the settings (time 0.1.43 of Rust installs the newest 0.1.x), and the packages a package brought with it (requests brings idna and urllib3).
Before the image is built (the language was never run on this server, or its build failed) only the packages named in the settings are audited, at the version named or the newest one, and the page says so. Composer refuses to install a version with known advisories : such an image is not built, and the audit still shows what is wrong with the package.
What to do is said per package : set it to version x for a package you added (in Sandbox settings), rebuild the image for a package another one brought, a newer version of the runtime or an API Maker update for what came with the image. Compare versions shows what each newer version of a package asked for by name would bring ; for a package of another language than JavaScript it compares the advisories of each version itself.
API Maker : what the server is made of. API Maker v4 is built from crates of Rust : the crates compiled into it are audited against OSV (the RustSec database), and their fixed versions read from crates.io. They change with an update of API Maker : Deploy API Maker.
An audit is kept for an hour; an older one (up to 7 days) is shown at once while a new one runs, and Check now asks the registries again. Only package names and versions leave the server.

Encrypted and hashed fields¶

Schema conversions can store a field encrypted or as an HMAC SHA-256 hash, with the keys of your secret.

Good to know¶

API Maker itself speaks plain HTTP on its port. Serve it over HTTPS : Launchpad puts a reverse proxy with certificates in front of it, or turns on the built-in web server.
Encrypted payloads do not replace HTTPS. They add a layer on top of it, useful when TLS ends before API Maker.