Limit API Key scope

[jpmeijers]

• I have searched the issues of this repository and believe that this is not a duplicate.

Summary

Currently an API Key has access to everything under a tenant or ChirpStack instance. I want to limit the API key's scope to only allow certain API calls.

What is the use-case?

Security best practices dictate that clients (services) should have the least amount of access - only access to what is needed.

For example I want to create a service that is only interested in the ListGatewaysRequest RPC, and for security I do not want this service to also manage Applications and Devices. Maybe I even want to give the API Key to a third party, and only allow them to see data for gateways and not applications or devices.

Implementation description

When creating an API Key, allow to choose scopes that this Key will have access to.

Can you implement this by yourself and make a pull request?

No