Access & security

Organization → Security, Members and Account → Access tokens hold everything about who can access what. Every change is written to the audit log.

Scoped tokens (PATs)

A token carries a list of permissions (projects:read, db:write, functions:deploy, secrets:write, backups:write …), an optional binding to one organization or project, an expiry date and a last-used timestamp. The secret is shown once and stored hashed. write implies read; projects:delete must be granted explicitly and * means full access. Older tokens without scopes keep working as full access until you replace them.

Scopes are enforced in the Management API and MCP: a missing permission returns 403, an expired or revoked token 401, and the MCP tool list only contains what the token may call. The effective permission is the intersection of the token scope and the token owner's role in that project. An org policy can cap token lifetime.

Per-project roles

Org roles (Owner, Admin, Developer, Read-only) are inherited by every project. Under Members → Project access you can override the role for one project: Viewer, Developer, Admin, Billing (status and billing only) or No access (the project is hidden). Owners cannot be restricted. The permission matrix is shown on the same page.

SCIM 2.0

Team and Enterprise plans. Generate a token under Security → SCIM and paste it, with the base URL, into Entra ID, Okta or Google Workspace:

Tenant URL: https://host.ulewicz.space/api/scim/v2
Authorization: Bearer hb_scim_...

Supported: /Users, /Groups, /ServiceProviderConfig, /ResourceTypes, /Schemas, PATCH, eq filters and pagination. Map IdP groups to roles with group name = admin | developer | readonly; the highest role wins and unmapped users get the default role (read-only by default). Deactivating a user removes them from the organization, ends their SSO sessions and revokes their org-bound tokens. SCIM never changes or removes owners, never rewrites the profile of accounts with their own password, and with verified SSO domains only accepts addresses from those domains.

Org policies

• IP allowlist (IPv4/IPv6, CIDR) for the dashboard and/or the Management API and MCP. Saving is refused if your own address would be locked out.
• Max session age (1 hour – 30 days); the strictest limit across your organizations applies.
• Enforced MFA for all members or only owners and admins.
• Max token lifetime (7–365 days).