Resource Binding

A user who manages three syndicates can authorize an app that should only ever touch one of them. Resource binding attaches that limit to the token itself, so the API enforces it on every request regardless of what the user could otherwise access.

Binding a token at authorization

Add three parameters to the authorization request:

GET https://wefunder.com/oauth/authorize?
  client_id=...&
  response_type=code&
  scope=read:syndicates write:syndicates&
  resource_type=syndicate&
  resource_id=syn_aB3xQ9k2vF8mNp1zT5wY7Qc4&
  resource_scope=required&
  ...

Param	Values	Meaning
resource_type	syndicate	The kind of resource to bind to
resource_id	syn_...	The syndicate's API id
resource_scope	required or optional	required confines the token to this resource. optional records the binding as a hint without enforcing it

The binding is stored on the grant and carried onto every token minted from it, including refreshed ones.

What a bound token can do

With resource_scope=required the token can read and act on the bound syndicate and nothing else:

• Syndicate endpoints for another syndicate return 403 with type: "forbidden" and a message that the token is not bound to that resource.
• Intents can be proposed only for the bound syndicate.
• The user's other syndicates are invisible to the token even though the user manages them.

Scopes still apply on top of the binding. A token bound to one syndicate with only read:syndicates cannot write to it.

Syndicate-owned tokens

An alternative for tools that belong to the syndicate rather than to one manager: pass grant_to=syndicate&syndicate_id=syn_... on the authorization request. The authorizing user must be able to edit the syndicate. The resulting token:

• is owned by the syndicate, with the authorizing user recorded;
• is restricted to read:syndicates and write:syndicates (other requested scopes are stripped; if none remain the request fails with invalid_scope);
• is automatically bound to that syndicate with resource_scope=required.

Use this when the integration should keep working if the person who set it up leaves the syndicate's team.

Unbound tokens

Without a binding, a token with read:syndicates sees every syndicate the user has permission on, and the API decides per request from the user's roles. That is the right default for a general-purpose tool the user points at whatever they manage.