Source PR: #335 · docs/rfcs/0025-scoped-remote-permission.md · @BigTava
Description
A Credential { domain, path, method } variant of RemotePermission grants outbound access to one endpoint, and the host attaches a ring VRF personhood proof to every request the grant covers.
Motivation
A product cannot hold a server-side API key, and Remote is too coarse either to approve a single endpoint or to prove that a stable person is behind the call.
Requirements
- The variant is appended last, so stored permission keys stay valid.
- One
(domain, path, method) triple per grant, https only, no wildcards.
- Denied without a session or people-set membership; the prompt names the endpoint and the alias disclosure.
- Every covered request carries
X-Polkadot-Proof, -Ring, -Timestamp and -Nonce.
Tasks
Source PR: #335 ·
docs/rfcs/0025-scoped-remote-permission.md· @BigTavaDescription
A
Credential { domain, path, method }variant ofRemotePermissiongrants outbound access to one endpoint, and the host attaches a ring VRF personhood proof to every request the grant covers.Motivation
A product cannot hold a server-side API key, and
Remoteis too coarse either to approve a single endpoint or to prove that a stable person is behind the call.Requirements
(domain, path, method)triple per grant, https only, no wildcards.X-Polkadot-Proof,-Ring,-Timestampand-Nonce.Tasks