Security

Tokens

Do	Don’t
Project JWT in the end-user app	kfxs_… or kfx_… in the app or NEXT_PUBLIC_* / EXPO_PUBLIC_*
Service token only on a server	Log service tokens or commit them
PAT for MCP and admin scripts	Share one PAT across untrusted machines without rotation

Platform tokens and service tokens bypass Kallax access rules. Anyone who has them can read and write collections the endpoints expose.

Rules

On every user-owned collection, for each enabled method:

1. requireAuth
2. userFieldCompare mapping _users._id to an owner field (authorId, userId, …)
3. File rules on upload

Empty rules mean allow unless the server sets STRICT_ACCESS_RULES. Do not rely on “auth is on” alone.

Seed authorId from the logged-in user in the client and enforce it with rules so a caller cannot set another user’s id.

Files

Declare real contentType and size when opening an upload session. Pair fileSizeLimit / fileMimeType / fileExtensionAllow with the global size cap.

CORS

Browser apps may call /api/p/... directly. Treat every collection endpoint as public to the internet, gated only by tokens and rules.