Access Model

voltage access has several layers choose the layer that matches the work team level dashboard access, an environment scoped payments api key, an organization scoped infrastructure api key, or direct lnd credentials these credentials are not interchangeable grant the narrowest access that supports the required workflow quick guide need use scope view team resources in the dashboard team read team level ui access where the route permits it operate supported resources in the dashboard team write team level ui actions where the route permits them application access to payments payments api key one payments environment and the key's permissions automate hosted node management infrastructure api key organization scoped infrastructure workflows; keys are owner managed call lnd directly lnd endpoint, tls material, and macaroon methods authorized by that macaroon team permissions team permissions govern human access to the voltage dashboard they are not scoped to a single payments environment read view resources on permitted pages write create or modify supported resources and settings on permitted pages team management invite, remove, and update team members and their roles owner organization owner actions, including infrastructure api key management in the current product a permission name does not override a more specific credential or node security boundary payments ui permissions payments dashboard access follows team permissions team level ui permissions apply across the team's payments environments rather than to only staging or only production read view payments resources exposed by the dashboard write create or manage supported payments resources and create environment api keys when human ui access must be isolated between staging and production, use a separate team boundary and confirm the current operating model with your voltage owner payments api key permissions payments api keys are environment scoped a key can access only its selected environment and the actions allowed by its configured permissions read view supported resources in the selected environment write create or manage supported writable resources in the selected environment payments write access can affect funds available to payments wallets treat write keys as sensitive production credentials infrastructure dashboard permissions infrastructure dashboard access also follows team permissions, with additional checks for sensitive actions team write create or modify supported infrastructure resources and settings on permitted pages owner create, list, and delete infrastructure api keys in the current dashboard and backend node sensitive material team permissions alone do not bypass node password, macaroon, or other credential checks voltage infrastructure api the infrastructure api manages voltage hosted node infrastructure it is separate from both the payments api and direct lnd access purpose supported organization scoped node inventory, lifecycle, settings, and connection material workflows authentication an owner managed infrastructure api key sent in the x voltage auth header credential model infrastructure api keys do not replace payments api keys or lnd macaroons access boundary the infrastructure api does not bypass node password or lnd macaroon permissions see voltage infrastructure api for the maintained base url, lifecycle safeguards, and documentation scope direct node access direct lnd access is a separate path from dashboard permissions and api keys use the node endpoint and current tls or certificate material described in configuration use an lnd macaroon whose baked permissions match the required methods prefer narrow credentials for observation, invoicing, or other limited workflows keep macaroons, tls material, pairing phrases, and node credentials server side use node security and macaroons for the maintained custody and least privilege guidance historical remote lncli syntax remains omitted until current voltage support is verified recommended setup keep team owner and team management access limited to trusted operators use team read or write only for the dashboard work each person needs use separate teams when human staging and production ui access must be isolated issue environment scoped payments api keys to applications that use the payments api have an organization owner create dedicated infrastructure api keys for backend node management systems use narrowly scoped lnd macaroons for direct node integrations review and remove access during role changes, incidents, and production launches