@loopback/docs/site/apidocs/security.md

Documentation files rendered at [https://loopback.io](https://loopback.io)

---
lang: en
title: 'API docs: security'
keywords: LoopBack 4.0, LoopBack 4, Node.js, TypeScript, OpenAPI
sidebar: lb4_sidebar
editurl: https://github.com/loopbackio/loopback-next/tree/master/packages/security
permalink: /doc/en/lb4/apidocs.security.html
---

<!-- Do not edit this file. It is automatically generated by API Documenter. -->

[Home](./index.md) &gt; [@loopback/security](./security.md)

## security package

Common types/interfaces for LoopBack 4 security including authentication and authorization.

## Remarks

- Subject - It's the "who" for security - contains a set of Principles, a set of Credentials, and a set of Permissions - Principle - Represent a user, an application, or a device - Credential - Security attributes used to authenticate the subject. Such credentials include passwords, Kerberos tickets, and public key certificates. - Permission - It's the what for security.

## Classes

|  Class | Description |
|  --- | --- |
|  [DefaultSubject](./security.defaultsubject.md) | Default implementation of <code>Subject</code> |
|  [Permission](./security.permission.md) | <code>Permission</code> defines an action/access against a protected resource. It's the <code>what</code> for security.<!-- -->There are three levels of permissions<!-- -->- Resource level (Order, User) - Instance level (Order-0001, User-1001) - Property level (User-0001.email) |
|  [TypedPrincipal](./security.typedprincipal.md) |  |

## Interfaces

|  Interface | Description |
|  --- | --- |
|  [ClientApplication](./security.clientapplication.md) |  |
|  [Credential](./security.credential.md) | Security attributes used to authenticate the subject. Such credentials include passwords, Kerberos tickets, and public key certificates. |
|  [Organization](./security.organization.md) |  |
|  [Principal](./security.principal.md) | Represent a user, an application, or a device |
|  [Role](./security.role.md) |  |
|  [Scope](./security.scope.md) | oAuth 2.0 scope |
|  [Subject](./security.subject.md) | <code>Subject</code> represents both security state and operations for a single request. It's the <code>who</code> for security.<!-- -->Such operations include: - authentication (login) - authorization (access control) - session access - logout |
|  [Team](./security.team.md) |  |
|  [UserProfile](./security.userprofile.md) | The minimum set of attributes that describe a user. |

## Namespaces

|  Namespace | Description |
|  --- | --- |
|  [SecurityBindings](./security.securitybindings.md) | Binding keys for security related metadata |

## Variables

|  Variable | Description |
|  --- | --- |
|  [securityId](./security.securityid.md) | A symbol for stringified id of security related objects |