Better security with fine grained API permissions

[enlm]

Instead of general API key for all functions, can we generate API key that can only be used for certain function like create TXT record with particular name such as for ACME challenge? That API key can’t do anything else than what it was created for.

[peter]

This is tracked here: api: Scoped tokens · Issue #347 · desec-io/desec-stack · GitHub

Stay secure,
Peter

[564656963]

The feature is implemented now:

New Token Scoping Interface

Hi all, We’ve deployed a new interface that allows configuring API tokens with higher granularity, on the per-RRset level. This allows, for example, to set up tokens that can’t manipulate any DNS records except for ACME challenges. The new interface is described here: Manage Tokens — deSEC DNS API documentation Old tokens, including their configuration, remain valid. In particular: If you used the previous version (“domain scoping” instead of RRset scoping), these tokens now have subname an…