Secure the appliance

Protect who can call a surface, who can administer the appliance itself, and the credentials it holds on your behalf. Field-level reference for every mechanism here is in Source authentication →, Secrets →, and RBAC →.

GuideWhat you will achieve
Validate bearer tokens on a surfaceCreate a JWT verification strategy and attach it to a surface so only callers with a valid, correctly issued token can reach it.
Rotate provider credentials without downtimeUpdate a stored secret’s value in place so every surface referencing it picks up the new credential on its next request, with no surface reconfiguration.
Limit dashboard actions with RBAC rolesAssign the administrator, poweruser, or user role to a dashboard account so it can only perform the actions its job requires.