Scoped API proxy

Unofficial community project: BinaryLane does not currently provide native scoped API tokens. This proxy is Blake Kirkham's personal reference implementation, not a BinaryLane product, and is not developed, endorsed, or supported by BinaryLane. You are responsible for reviewing, operating, updating, and securing it. Use it at your own risk.

This project puts a customer-managed APISIX gateway between users and the BinaryLane API. The BinaryLane master API token stays on the gateway, while each user authenticates with a short-lived JWT and is limited by a locally configured role.

It may suit a team that needs to delegate limited API access before native permissions are available. It also adds another security-sensitive service to operate. If you do not need delegated access, calling the BinaryLane API directly is simpler.

• Source repository
• Raw cloud-init payload
• Security notes

The repository is the source of truth. Review the current code and validation results there before deploying; do not rely on an old copied payload.

1. Caddy terminates public HTTPS, or the service is reached over a trusted private path.
2. APISIX validates a per-user HMAC-SHA256 JWT.
3. A generated policy maps the request to an allowed action for that user's role.
4. APISIX injects the master BinaryLane API token only on the upstream request.
5. Unknown or newly added API operations fail closed until the policy is reviewed.

The reference stack uses Docker Compose, APISIX, etcd, and Caddy on an Ubuntu 24.04 VPS.

The guide is split into three focused pages. You can follow them in order or open only the section you need.

Prepare the VPS, deploy the cloud-init payload, verify the services, and complete activation.

Open the deployment guide →

Create users and roles, assign permitted actions, and issue short-lived JWTs.

Open the users, roles, and JWTs guide →

Maintain and update the proxy, review its security boundaries, and diagnose common failures.

Open the operations and troubleshooting guide →

A community-developed web GUI is available at Binary Lane API Proxy GUI. It is designed to work alongside the JWT-scoped API proxy deployed by this guide and can manage consumers and role assignments through a browser.

Important: This GUI is not developed or maintained by BinaryLane, and is separate from this reference implementation. Review its code and operating requirements before use. For issues with the GUI, use the community project's issue tracker.

BinaryLane Support may answer questions about the public BinaryLane API and VPS platform. Installation, policy design, proxy administration, operating-system maintenance, and incident response for this project remain customer-managed work.