Skip to main content

Authentication & Access

Smart EPD supports multiple authentication methods and a layered permission model that controls access at every level of the platform hierarchy.

Authentication methods​

MethodUse caseHow it works
Email codeInteractive login (UI and API)Request a 6-digit code sent to your email, then exchange it for a JWT
JWT Bearer tokenAPI requestsInclude Authorization: Bearer <token> on every request. Tokens expire after 100 hours.
API KeyAutomated integrationsCreate a long-lived key (sk_...) via the API. Scoped to read_only or read_write.
Session cookieAdmin panelStandard cookie-based auth
NonePublic EPD libraryGET /api/v2/public/epds/ and the public EPD view are anonymous: send no credentials. See Public EPD library.

Login flow​

API Keys​

For automated integrations (tool providers, CI/CD pipelines, data sync), API keys provide stable, long-lived authentication:

  • Created via the API (requires JWT auth)
  • Prefixed with sk_ for easy identification
  • Scoped to either read-only or read-write
  • The raw key is shown once on creation; store it securely

Use API keys in the same Authorization: Bearer sk_... header format as JWTs.

Public EPD library​

Published EPDs are public content, so the endpoints that serve them need no authentication:

  • GET /api/v2/public/epds/ lists every publicly listed EPD across both Smart EPD platforms.
  • GET /api/v2/public/epds/{id}/view/ returns one EPD's full digital declaration.

They only ever return published, unexpired EPDs. An unpublished or expired EPD returns 404, exactly like an id that doesn't exist, so nothing about a draft can be learned from them. Sending credentials is harmless but changes nothing. See the Public EPD Library guide.

Permission model​

Smart EPD uses a layered permission model where access is determined by your organization type, workspace role, and project membership.

Organization level​

Every user belongs to exactly one organization. Organization-level roles:

RolePermissions
AdminFull control: manage members, settings, billing
MemberStandard access: participate in workspaces and projects

Workspace level​

When an organization joins a workspace, all its members receive baseline access. Individual users can be elevated:

RolePermissions
AdminManage workspace members, invites, and member roles
EditorCreate and modify projects, EPDs, and submittals
ViewerRead-only access to all workspace content
Workspace and Category administration

Creating, editing, archiving, or deleting workspaces and Categories (PCCs) is a platform-administration action, separate from the workspace roles above. In production these operations are performed by SmartEPD platform admins — contact support to request a change. Outside production, admins of the workspace's owning organization can also perform them. Project creation is not affected: workspace editors and admins can always create projects.

Organization role in workspace​

Each organization has a role within the workspace that determines what actions are available:

Org RoleTypical actions
Reporting OrganizationOwns projects, creates EPDs, submits for verification
Tool ProviderRegisters tools in Categories, defines specifications, responds to verification
ConsultantPerforms LCA work and EPD creation on behalf of manufacturers
VerifierReviews and certifies specifications, templates, and EPDs

Project level​

Individual users are added to project teams with specific permissions:

PermissionEffect
Can edit EPDsUser can create and modify EPD content
Team memberUser can view project content and participate in chat

Access inheritance​

Permissions cascade downward through the hierarchy:

Organization membership
  └── Workspace membership (viewer by default for all org members)
        └── Category access (inherited from workspace)
              └── Project team membership (explicit assignment)

A user must have organization membership and workspace access and project team membership to edit EPD data. This ensures that access is always scoped and traceable.