5-minute quickstart

Get started in 5 minutes

From zero to checking permissions in production. No infrastructure to provision, no policy language to learn. Just an API key and a few lines of code.

Register and get your API key

Self-serve registration. No credit card. You get an API key immediately.

# Register your organization
curl -X POST https://api.wardenauthz.com/v1/register \
  -H "Content-Type: application/json" \
  -d '{"orgName": "acme", "adminEmail": "you@acme.com", "adminPassword": "..."}'

# Response: { "apiKey": "sk_abc123..." }
# Save this key — it will not be shown again.

Create a scope (tenant workspace)

Scopes isolate your customers' RBAC configurations. Each customer gets their own scope.

curl -X POST https://api.wardenauthz.com/v1/scope \
  -H "X-API-Key: sk_..." \
  -H "Content-Type: application/json" \
  -d '{"id": "acme-corp", "name": "Acme Corporation"}'

Create permissions and roles

Define what actions can be performed on what resources, then bundle them into roles.

Create permissions

# Invoice CRUD permissions
curl -X POST .../v1/scope/acme-corp/permission \
  -d '{"id": "inv-read", "resource": "invoice", "action": "read", "effect": "allow"}'
curl -X POST .../v1/scope/acme-corp/permission \
  -d '{"id": "inv-create", "resource": "invoice", "action": "create", "effect": "allow"}'
curl -X POST .../v1/scope/acme-corp/permission \
  -d '{"id": "inv-delete", "resource": "invoice", "action": "delete", "effect": "allow"}'

Create role

curl -X POST .../v1/scope/acme-corp/role \
  -d '{"id": "admin", "name": "Admin", "permissions": ["inv-read","inv-create","inv-delete"]}'

Assign role to a user

Bind a subject (user ID) to a role within a scope.

curl -X POST .../v1/scope/acme-corp/access-policy \
  -d '{"subjectId": "user_123", "roles": ["admin"]}'

Check access from your app

One API call in your application code. Returns the decision and the reason.

TypeScript

import { WardenAuth } from '@ecarrizo2/wardenauthz-js'
const client = new WardenAuth({ apiKey })
const { allowed } = await client.access.check({
  subjectId: 'user_123', scopeId: 'acme-corp',
  resource: 'invoice', action: 'delete',
})

import ac "github.com/ecarrizo2/wardenauthz-go"
client := ac.NewClient(ac.ClientConfig{APIKey: key})
result, _ := client.Access.HasAccess(ctx, ac.AccessCheckInput{
  SubjectId: "user_123", ScopeId: "acme-corp",
  Resource: "invoice", Action: "delete",
})

Ready to start?

Self-serve registration. 50,000 checks/month free. No credit card required.

Start free Full API reference →

# Register your organization curl -X POST https://api.wardenauthz.com/v1/register \ -H "Content-Type: application/json" \ -d '{"orgName": "acme", "adminEmail": "you@acme.com", "adminPassword": "..."}' # Response: { "apiKey": "sk_abc123..." } # Save this key — it will not be shown again.

# Invoice CRUD permissions curl -X POST .../v1/scope/acme-corp/permission \ -d '{"id": "inv-read", "resource": "invoice", "action": "read", "effect": "allow"}' curl -X POST .../v1/scope/acme-corp/permission \ -d '{"id": "inv-create", "resource": "invoice", "action": "create", "effect": "allow"}' curl -X POST .../v1/scope/acme-corp/permission \ -d '{"id": "inv-delete", "resource": "invoice", "action": "delete", "effect": "allow"}'

import { WardenAuth } from '@ecarrizo2/wardenauthz-js' const client = new WardenAuth({ apiKey }) const { allowed } = await client.access.check({ subjectId: 'user_123', scopeId: 'acme-corp', resource: 'invoice', action: 'delete', })

import ac "github.com/ecarrizo2/wardenauthz-go" client := ac.NewClient(ac.ClientConfig{APIKey: key}) result, _ := client.Access.HasAccess(ctx, ac.AccessCheckInput{ SubjectId: "user_123", ScopeId: "acme-corp", Resource: "invoice", Action: "delete", })