# 身分、租戶與授權

> Sites, team roles, API tokens, OAuth for assistants, service accounts and the activity log.

> Markdown version of https://kanorio.com/zh-Hant/developers/products/identity. Append `.md` to any developer docs URL for this format. Index: https://kanorio.com/llms.txt · MCP: https://app.kanorio.com/api/mcp
>
> Translated from the English original: https://kanorio.com/en/developers/products/identity.md

Status: **Available**

身分決定了誰在發出請求以及他們可以執行什麼操作。每個請求都限定於單一網站，且每個權杖的權限皆受限於其背後人員或服務帳戶的角色。

## 核心物件

- **網站 (Sites)。** 租戶邊界。資料絕不會在網站之間流動。
- **團隊成員與角色。** 擁有者、管理員、編輯者與自訂角色，以及存取請求。
- **權杖 (Tokens)。** 個人存取權杖、用於助理的 OAuth 存取權，以及服務帳戶權杖。請參閱 [身分驗證](https://kanorio.com/zh-Hant/developers/authentication)。
- **活動記錄 (Activity log)。** 在後台或透過 API 進行的每一項變更，以及執行變更的人員。

## API 的運作方式

- `GET /whoami` 顯示目前權杖可以執行的操作。
- 使用 Management API 列出與建立網站、讀取使用量與活動記錄。
- 客戶可以存取的內容屬於 [客戶、會員資格與權益](https://kanorio.com/zh-Hant/developers/products/customers)，而非身分系統。

## What the APIs expose

| Capability | Status | API | Elements | Hosted site | Webhooks |
| --- | --- | --- | --- | --- | --- |
| Site team RBAC (custom roles, access requests), personal access tokens, service accounts and OAuth 2.1 for the Management API, customer session tokens | Available | PAT (`knr_pat_`), OAuth 2.1 (`knr_at_`) with site scope; `auth.whoami?websiteId=` reports role vs. token scope; Customer Bearer (`knr_cat_`) bound to `(websiteId, contactId)` | `<kanorio-login>` | `/settings/team`, `/settings/team/roles`, `/account/api-access` | `team.accessRequest.created` |
| Custom end-user application roles (e.g. teacher / TA / branch manager in your own app) | Not offered | — | — | — | — |
| Enterprise SSO (SAML / OIDC / SCIM) & custom contractual uptime SLA | Not offered | — | — | — | — |

## API reference

- Management API: [Sites](https://kanorio.com/en/developers/management-api/sites) (6 operations)
- Management API: [Auth](https://kanorio.com/en/developers/management-api/auth) (1 operations)

## Webhook events

- `site.subscription.upcomingRenewal`: Fired before an annual plan renews when annual add-ons or pending add-on / platform fees will be charged on the same invoice.
- `site.subscription.addOnPriceChange`: Fired at least 30 days before add-on prices change for the site, with the per-level price changes and effective date.
- `team.accessRequest.created`: Fired when a team member requests permissions they are missing, so people who manage the team can review it.

Payloads: https://kanorio.com/en/developers/webhooks/events

## Recent changes

- 2026-10-28: Service account tokens (knr_sa_)
- 2026-10-24: Fine-grained scopes for publishing, domains, developer settings, media, orders and collection schemas
- 2026-10-23: Activity log redacts internal fields of platform actions
- 2026-10-14: OAuth client authentication, scope defaults and stability labels

Full changelog: https://kanorio.com/en/developers/changelog

## For site owners

Dashboard help: https://kanorio.com/zh-Hant/help/team-permissions