How are scoped keys to be used for writes? (Scoped write keys return 401 unauthorized.)

Question

How are scope keys used for write operations?

When I try to use a (scoped) write key, the API responds 401 Unauthorized; the "master write key" works like a charm. Using a scope key for read operations works as well.

I assume my selection of filters etc. isn't working out, but I can't find any details in the documentation on how scope keys work for write operations.

(For context, I am working to constrain scope keys to enforce certain parameter values. In essence, using the scope keys to "shard" the collections on a given key so that multiple tenants can write to the same collection, while not being able to falsify each other's values.)

I use a filter like the following:

{
  "filters": [
    {
      "property_name": "whatever",
      "operator": "eq",
      "property_value": "client value"
    }
  ],
  "allowed_operations": ["write"]
}

I use the .net SDK to create the scope key, and can verify the filter values through decrypting the key afterwards. It will get used on a web app, so using the Keen IO JS library, similar to:

var client = new Keen({
    projectId: "…",
    writeKey: "…", // <- generated scoped write key goes here
    readKey: "…",
    protocol: "https",
    host: "api.keen.io/3.0",
    requestType: "jsonp"
});

client.addEvent("my-collection", { /* … */ }, function (err, res) { /* … */ });

What's the SOP for scoped writes on Keen.IO?

score 2 · Accepted Answer · answered May 18 '15 at 18:06

SOP: the Keen API expects you to supply the write enabled scoped key as the writeKey in your POST request.

Scoped keys for write operations won't perform as you're suggesting (at least not today). Currently scoped keys for writes do nothing more than obfuscate your master/write keys. All property data that you append as part of each event must still be supplied in the JSON payload of the addEvent method on the client side.

We generally recommend server side implementations in cases where you need to protect/manipulate your writes before you send them to Keen.

How are scoped keys to be used for writes? (Scoped write keys return 401 unauthorized.)

1 Answers1