Feature: API keys with limited scope and permissions [Security by Design]

[jeroenhabets]

Feature: API keys with limited scope and permissions [Security by Design] logged in the Bitwarden community:

In our Security by Design setup we’d like to be able to use BitWarden (cli, api) in our automation according to least privileges.

One way would be to allow multiple API keys per user (or org?) and be able to give these limited scope; e.g. only one collection and/or one or more secrets.
As here only read-only access is required, ideally that would be an option too (read-only, read/write, admin = incl. create/delete)

E.g. if a system is only allowed to update our monitoring, we could create an API key for that system that can read our monitoring credentials (in a separate collection).

Raising it here as well in the hope of getting more traction (votes) and nothing else as I suppose Vaultwarden follows in features like these or does it also lead sometimes?

[BlackDex]

Depending on the possibilities, we mostly follow and not lead. Some items are Vaultwarden specific and some are Bitwarden only.

What i might think what you are looking for is https://bitwarden.com/products/secrets-manager/, which is a Bitwarden Licensed feature, and not something we can build-in into Vaultwarden it self using the same ease.

Also, the clients need to support this in some way, and deviating from this would only make it harder for us to keep in pair with Bitwarden.