Bosca / Gateway

Access

Who gets through, and as whom

Each route chooses how callers prove who they are, which groups may read and which may write — and what the upstream learns about the person on the other end.

Sign-in

Four ways in, chosen per route

The same route table can hold an API secured by tokens, a dashboard that rides the Studio session, and a public health endpoint — each with the sign-in that fits it.

  • Tokens — for APIs and automation, using the platform's own tokens.
  • Browser session — signed into Studio means signed into the service; ideal for dashboards.
  • Username and password — for older tools that only speak basic sign-in, validated against the platform.
  • Public — no sign-in. Studio flags public routes in amber so nothing is exposed by oversight.
auth per route
/warehouse/**OAuth2
/api/reports/**JWT
/legacy/**Basic
/healthPublic

Groups

Reading and writing are different privileges

Viewing a dashboard and changing what's behind it aren't the same thing, so a route grants them separately — each to the groups you choose.

  • Read groups — who may make safe requests: fetching pages, loading data.
  • Write groups — who may change things: posts, updates, deletes.
  • Tokens carry scopes — an API token needs the gateway's read or write scope, on top of its group memberships.
/warehouse/** access
Readanalysts
Writedata-eng
Token scopegateway:read

Forwarded identity

The upstream learns who's asking

Services behind the gateway don't have to know what Bosca is. A route can inject headers on the way through, filled from the signed-in caller and the request itself.

  • Who — the caller's name, email, subject, and groups, dropped into whatever header names the upstream expects.
  • Where from — the original host, scheme, port, and client address, for services that care.
  • Per route — one upstream can receive full identity while another gets a clean, header-free pass-through.
injected headers
X-Userjane@example.com
X-Groupsanalysts
X-Forwarded-Hoststudio.example.com

Keep exploring

More on Gateway

Gateway overview

Your services, behind one authenticated front door.

Upstreams

Register a service, watch its health, tune its connection.

Routes

Path and host patterns that decide where requests go.