Per-collection, per-action scope
Grant exactly find, create, update, or delete on exactly the collections an integration touches — nothing implicit.
DevelopersAPI KEYS & AUTHENTICATION
Least privilege, not one all-access token.
A single all-powerful API key is a liability the moment it leaks. CMSHub's machine credentials carry explicit per-collection action permissions — find, create, update, or delete — so an integration only ever holds the access it actually needs, and a leaked key has a small, known blast radius.
01 / MACHINE CREDENTIALS
Scoped API keys, not a master key
Create, rotate, and revoke API keys per workspace, each limited to specific collections and specific actions on them — the same principle of least privilege you'd apply to any production credential.
Create, rotate, revoke
Manage a key's lifecycle from the workspace — rotate it on a schedule or revoke it immediately if it's exposed.
Deny by default
A key with no explicit grant on a collection can't touch it — there's no implicit fallback to broader access.
02 / HUMAN SESSIONS
Hardened credentials, revocable sessions
Human logins use Argon2id-derived credentials — a modern, memory-hard hashing algorithm — with server-side sessions wrapped in JWTs that can be revoked immediately, not just left to expire.
Argon2id-derived credentials
Passwords are hashed with Argon2id, resistant to GPU and ASIC-accelerated cracking attempts.
Revocable sessions
Server-side sessions mean a compromised session can be revoked immediately, without waiting on token expiry.
Auditable auth events
Logins, session revocations, and key changes are recorded so you can answer who accessed what, and when.
CREATE A SCOPED KEY
Issue an API key limited to one collection.
Open a workspace and create a key scoped to exactly the access your integration needs.