beta · guide · 0.1.0

Authorize an embedded component for one resource

The Project Backend remains authoritative. After it verifies the browser session, Project Membership, resource visibility, and requested action, it may use a Project Credential with resource-grants:write to call POST /browser-resource-grants. Every requested action must also be in the Project Client's allowed scopes. An action may append one /target qualifier, such as reports:write/{comment_id}; MiniCenter authorizes the scope before / and the consuming component must match the full qualified action. Never send the Project Credential to a browser.

Shell example

curl --fail-with-body -X POST "${MINICENTER_URL}/api/v1/browser-resource-grants" \
  -H "Authorization: Bearer ${MINICENTER_PROJECT_CREDENTIAL}" \
  -H 'Content-Type: application/json' \
  --data '{"platform_account_id":"30000000-0000-4000-8000-000000000003","resource_type":"article","resource_id":"article-42","actions":["comments:read","comments:write"],"origin":"https://app.example.test"}'

Return only data.token and data.expires_at to the browser. The named origin must be an active, exact Project Client Browser Origin.

The embedded component sends its intended Project Client, resource, and one action to POST /browser-resource-grants/consume. MiniCenter also verifies the browser Origin header. A successful exchange returns the Platform Account and exact authorized resource context and immediately consumes the token.

Shell example

curl --fail-with-body -X POST "${MINICENTER_URL}/api/v1/browser-resource-grants/consume" \
  -H 'Origin: https://app.example.test' \
  -H 'Content-Type: application/json' \
  --data '{"token":"'"${MINICENTER_BROWSER_GRANT}"'","project_client_id":"40000000-0000-4000-8000-000000000004","resource_type":"article","resource_id":"article-42","action":"comments:read"}'

The grant expires after five minutes and is single-use. A well-formed token with an expiry, replay, revoked or mismatched origin, Project Client, resource, or action returns the same invalid_browser_resource_grant response; malformed requests return validation_failed. Request a fresh authorization from the Project Backend; do not retry or log the token.