Users, sharing, and approvals

Marina authenticates every viewer before a request reaches your app. You do not build sign-in; you decide who an app is shared with, and your code reads who is asking.

Who is making the request

Each request arrives with identity headers your code can trust:

Header	Value
`x-platform-principal`	`user` for a signed-in user.
`x-platform-user-id`	The signed-in user’s stable id.
`x-platform-workspace-id`	The workspace the app belongs to.

const userId = request.headers.get("x-platform-user-id");
const rows = await marina.db.query(
  "select * from expenses where owner_id = $1",
  [userId],
);

Use the user id in your data model and query predicates. Marina isolates apps from each other; separating one app’s users from each other is your code’s job.

Requests without a browser

Two features let callers without a Marina sign-in reach an app that handles requests. Neither carries a user id, and x-platform-principal tells your code which kind of request it is handling.

Caller	Use	`x-platform-principal`
CI jobs, scripts, and other services	App keys: keys with scopes your app declares, valid until revoked or expired.	`app-key`
A device or service that needs one route briefly, such as a download or callback	Temporary links: URLs for one route that your app creates, valid for at most 15 minutes.	`grant`

A new app is visible to its creator and to workspace admins. Share it from the app’s sharing controls, per person or with the whole workspace, with one of three roles:

Role	Can
Viewer	Open and use the app.
Editor	Also change the app: edit in Studio and deploy new versions.
Publisher	Also approve versions and manage the app.

Guests are people outside your workspace membership, invited by email from an app’s sharing settings. They can use the apps shared with them and nothing else: no connections, no groups, no workspace settings.

Approvals

Deployments that expand what an app can touch require approval before the version goes live: a new runtime service, a new connection or operation, or database migrations. The exact changes appear as plain-language effects (“Let this app read mercury/evident: transactions.list”) in the Inbox of people who can approve, and the approved list becomes that version’s fixed authority. Deployments that change only code publish without a review.

Get started

Guides

Platform services

Connections

Reference

Users, sharing, and approvals

Who is making the request

Requests without a browser

Approvals

​Who is making the request

​Requests without a browser

​Sharing an app

​Approvals

Who is making the request

Requests without a browser

Sharing an app

Approvals