Unofficial community project: BinaryLane does not currently provide native scoped API tokens. This proxy is Blake Kirkham's personal reference implementation, not a BinaryLane product, and is not developed, endorsed, or supported by BinaryLane. You are responsible for reviewing, operating, updating, and securing it. Use it at your own risk.

This project puts a customer-managed APISIX gateway between users and the BinaryLane API. The BinaryLane master API token stays on the gateway, while each user authenticates with a short-lived JWT and is limited by a locally configured role.

It may suit a team that needs to delegate limited API access before native permissions are available. It also adds another security-sensitive service to operate. If you do not need delegated access, calling the BinaryLane API directly is simpler.

• Source repository
• Raw cloud-init payload
• Security notes

The repository is the source of truth. Review the current code and validation results there before deploying; do not rely on an old copied payload.

1. Caddy terminates public HTTPS, or the service is reached over a trusted private path.
2. APISIX validates a per-user HMAC-SHA256 JWT.
3. A generated policy maps the request to an allowed action for that user's role.
4. APISIX injects the master BinaryLane API token only on the upstream request.
5. Unknown or newly added API operations fail closed until the policy is reviewed.

The reference stack uses Docker Compose, APISIX, etcd, and Caddy on an Ubuntu 24.04 VPS.

• Deploy and activate
• Users, roles, and JWTs
• Operations, security, and troubleshooting

BinaryLane Support may answer questions about the public BinaryLane API and VPS platform. Installation, policy design, proxy administration, operating-system maintenance, and incident response for this project remain customer-managed work.