Skip to main content
Darpan access is session-based; users sign in, receive a session, and operate within the active company or active tenant available to them.

​
User context

Some users may belong to more than one company or tenant. When that is enabled, the active company or active tenant controls which scoped records they read and write.

​
Permission context

Permissions are evaluated for the active company or active tenant. A user can have different capabilities in different companies or tenants.

​
Product roles

Tenant Admins should confirm the active tenant before saving settings, connection records, schemas, saved runs, or automations.

​
Sensitive auth values

Examples use placeholders for usernames, passwords, session cookies, login keys, CSRF tokens, and sensitive auth artifacts.

​
API calls

Backend JSON-RPC calls usually require:
  • For the browser app: an authenticated session cookie and a valid X-CSRF-Token
  • For integration callers: a login_key header instead of the cookie and CSRF token
  • Permission for the target service
For backend API authentication details, see JSON-RPC reference.