Security groups
Named sets of API client credentials - many partners on one channel, each with its own revocable definition.
Overview
A security group is a named set of security definitions. A channel with one directly assigned definition has one credential - a channel with groups has as many as the groups hold members. Each partner or application keeps its own credentials, and revoking one client's access is removing its definition from the group, without touching the channel or the other clients.
Three definition types can be group members:
- Basic Auth - a username and password in the
Authorizationheader - API keys - a key in the header the channel's API key definitions name
- Bearer tokens - static tokens and JWTs in the
Authorizationheader
Groups are managed in the dashboard under Security > Groups. Changes take effect immediately, without server restarts.
Definition fields
| Field | Notes |
|---|---|
| Name | A unique name for the group |
| Quota tier | Optional - a quota tier that applies to every member of the group |
| Members | The security definitions that belong to the group, picked from the available Basic Auth, API key and Bearer token definitions |
Groups are exported and imported with enmasse under the top-level groups key - the fields are in the enmasse reference.
Channels
Assign one or more groups in a REST channel's create or edit form and a request is allowed through when its credential matches any member of any of the channel's groups. In service code, self.channel.security.username names the member whose credential authenticated the request, so you can tell which client made each call.
A channel secured through groups answers failed authentication with 403, both for a wrong credential and for a missing one - only a directly assigned definition answers 401 with a WWW-Authenticate challenge. The constraints that keep a channel's groups unambiguous, and the header rules for API key members, are described under security groups for REST channels.
MCP gateways
Each MCP gateway automatically creates its own group named mcp.<gateway-name> - the gateway's security picker manages that group's members, and the group is visible under Security > Groups like any other. Which credential types agents present and what rejections log is described under MCP gateway security.
Quota tiers
A quota tier set on a group applies to every member, with per-member counting. A member's own rules or its own tier take precedence over the group's tier.
Live changes
Group membership changes are reflected in enforcement immediately - adding a member grants access on the next request and removing one revokes it, without restarts and without redeployments.