JWT tokens and tenants

Barq sync uses signed access tokens.

The server verifies the token and uses the verified claims to scope synced data.

Single Public Key

Use one public key for all accepted tokens:

barq-server-dbg \
  --root-dir ./barq-sync-data \
  --jwt-public-key ./public.pem

Per-tenant Keys

Use --jwt-public-key-dir for per-tenant keys.

barq-server-dbg \
  --root-dir ./barq-sync-data \
  --jwt-public-key-dir ./tenant-keys

Supported key layouts:

tenant-a.pem
tenant-b.pem
tenant-c/key-1.pem
tenant-c/key-2.pem

Tenant Isolation

In multi-tenant mode, the server derives the tenant from the verified token. It stores files under that tenant path.

The client can ask for partition shared, but it cannot choose another tenant’s path.

Per-tenant Encryption

barq-server-dbg \
  --root-dir ./barq-sync-data \
  --jwt-public-key-dir ./tenant-keys \
  --tenant-encryption-master-key ./master-secret.bin

The server derives a separate database key per tenant.