Access

Access has two parts: whether the service is private, and which of its tools are public.

Private and public services

• A service is private from its first deploy. Only its own account and that account's members can see or call it, and everyone else gets 404.
• An owner makes it public with PUT /services/{owner}/{name}/visibility and the body {"private": false}. GET on the same path reads it.
• Any signed-in account can call a public service's public tools.

Caller	Private service	Public service
A session of an owner or member of the account	Public tools	Public tools
An API key made on the account	Public tools	Public tools
Any other session or API key	404	Public tools
An app	See From your app	See From your app

Public tools

• Only a tool marked #[public] can be called from outside the service, by anyone, its owners included. The other tools run only as the service's crons, wakes and Stripe events.
• A deploy that makes a tool public is refused until public in berm.toml lists it.
• #[callers(services)] limits a public tool to calls from other services, and #[callers(accounts)] to calls from outside. The other kind of caller gets 403.

Anonymous tools

• A tool marked #[anonymous] is the only kind a call with no signed-in caller reaches. It must also be #[public].
• A call with no caller comes through an app that admits anonymous calls. See From your app.
• A request with no token and no app answers 401, #[anonymous] tools included.