Access Control

Postgram secures all mutating and privileged operations behind API keys and server-side authorization checks.

What this page covers

This page summarizes the key controls: API key scopes, visibility, entity type restrictions, and operational patterns for key lifecycle.

Core workflow

1. Create a key in the Admin Overview tab, or use the repository-local admin wrapper for an advanced/operator workflow:

./bin/pgm-admin key create \
  --name local \
  --scopes read,write,delete \
  --visibility personal,work,shared

2. Use the key in all REST, MCP, and CLI requests via Authorization: Bearer <key> or PGM_API_KEY.
3. Restrict keys by:
   • scopes (read, write, delete, sync)
   • visibility levels
   • allowed entity types (as configured in your deployment).

Notes

• Every REST request must pass Authorization: Bearer <api-key>.
• Keep admin-level commands and audit-sensitive operations to dedicated keys.
• Visibility restrictions complement role-based design for personal/work/shared separation.