--- title: Security Model description: "--- ###### Elements offers a proven security model with three levels of access for users. Take advantage of SSO with Facebook and Apple accounts, or native account login - all with [Profile](https://namazustudios.com/glossary/profile/) management. Elements uses a three-tiered security model through…" url: "https://namazustudios.com/docs/general-concepts/security-model/" updated: "2026-08-13" category: General Concepts --- # Security Model --- ###### Elements offers a proven security model with three levels of access for users. Take advantage of SSO with Facebook and Apple accounts, or native account login - all with [Profile](https://namazustudios.com/glossary/profile/) management. Elements uses a three-tiered security model through a single API. When accessing the API a [User](https://namazustudios.com/glossary/user/) may access at one of three access levels. Briefly, these include: - **Anonymous** - the [User](https://namazustudios.com/glossary/user/) is not logged in or has not provided any valid access credentials. - **[User](https://namazustudios.com/glossary/user/)** - the [User](https://namazustudios.com/glossary/user/) is a regular [User](https://namazustudios.com/glossary/user/) and can access some APIs intended for the general purpose users. - **Superuser** - the [User](https://namazustudios.com/glossary/user/) can access full APIs which generally includes access to all records in the system. ### [User](https://namazustudios.com/glossary/user/) Access Levels (Detailed Overview) [#levels-of-access-for-users](#levels-of-access-for-users) Currently, a [User](https://namazustudios.com/glossary/user/) may have one of the three following access levels. This applies to the [User](https://namazustudios.com/glossary/user/)'s entire account. Across all of Elements, the security model applies as follows: 1. **Anonymous** (or Unprivileged) provides access to information that is considered public. Few APIs will supply information when used without any kind of credentials. Some APIs may only return limited sets of data at this level. Anonymous is the default access level and tends to grant very little access. If the client supplies no credentials, Elements will process all requests at this level. It is possible to greatly restrict a logged-in [User](https://namazustudios.com/glossary/user/)'s access by assigning this level. This will give the [User](https://namazustudios.com/glossary/user/) the same access level as if they were not logged in. It may, however, still allow for valid [Session](https://namazustudios.com/glossary/session/) creation. 2. **[User](https://namazustudios.com/glossary/user/)** is the level of access for all authenticated users. This is what the average [User](https://namazustudios.com/glossary/user/) will use when accessing your applications. When creating new accounts, the system will automatically assign users to this level of access. [User](https://namazustudios.com/glossary/user/) is the access level for normal users. Additionally, it is the default level for making new accounts. Only a Superuser may escalate a [User](https://namazustudios.com/glossary/user/)'s access level allowing for access to the whole system. In general, users of your [Application](https://namazustudios.com/glossary/application/) should always be assigned this level. 3. **Superuser** allows for complete control over the system. APIs may return all information requested. Admins may perform operations such editing [User](https://namazustudios.com/glossary/user/) accounts, resetting passwords for other users in the system, or adjust the [Application](https://namazustudios.com/glossary/application/) parameters. Using the [admin console](https://namazustudios.com/elementsmanual/quickstart/console/WebConsole) requires superuser access. Note Important: - Elements intercepts incoming requests as soon as possible, reads credentials information, and applies scope based on the [User](https://namazustudios.com/glossary/user/)-supplied credentials. - For a majority of endpoints, including those defined as cloud functions in the scripting engine, the [User](https://namazustudios.com/glossary/user/) scope will be set before the presentation layer receives the code. - Elements will instantiate the specific version of a [Service](https://namazustudios.com/elementsmanual/general/NTieredArchitecture/#service-layer) based on the access level. Additionally, when troubleshooting, it is often times useful to fetch the version endpoint which prints out the revision, build time, and version number by visiting this link in your local browser [http://localhost:8080/api/rest/version](http://localhost:8080/api/rest/version). This information should also be visible upon logging in to the admin console. At the time of this writing, Elements does not support full [User](https://namazustudios.com/glossary/user/) segmentation by group and permission scheme. This is a feature slated for future releases. However, future versions will still operate against group-based access. ## Signing in from your client code Username/password sign in is the default method of authentication within Elements which we'll use the for the example below. [See here](https://namazustudios.com/docs/namazu-elements-core/user-authentication-sign-in/user-authentication-in-elements/) for more information on [OIDC](https://namazustudios.com/glossary/oidc/)/[OAuth2](https://namazustudios.com/glossary/oauth2/) sign in. Regardless of the method, you will get back a [Session](https://namazustudios.com/glossary/session/) token, as described below. ### Create new [User](https://namazustudios.com/glossary/user/) [#create-new-user](#create-new-user) When someone signs up for Elements (via the `UserSignupApi`), they must provide a [User](https://namazustudios.com/glossary/user/) [name](https://namazustudios.com/glossary/name/), a password, and an email address. This will provide you with the new [User](https://namazustudios.com/glossary/user/) object in the response (but does not create a [Session](https://namazustudios.com/glossary/session/) token yet!), which will be needed for the next step. ### Sign in with existing [User](https://namazustudios.com/glossary/user/) [#sign-in-with-existing-user](#sign-in-with-existing-user) After creating the new [User](https://namazustudios.com/glossary/user/), or if someone has already created a [User](https://namazustudios.com/glossary/user/) in Elements, they can retrieve a [Session](https://namazustudios.com/glossary/session/) token with just the Username and Password via the **UsernamePasswordSessionApi**. This will return a **SessionCreation** object that contains the **SessionSecret** property, which is your [Session](https://namazustudios.com/glossary/session/) token. Once the [Session](https://namazustudios.com/glossary/session/) token has been retrieved, you can then authenticate [User](https://namazustudios.com/glossary/user/) related requests by adding the [Session](https://namazustudios.com/glossary/session/) token to the singleton client configuration in your generated code. For example: ``` C# Headers["Elements-SessionSecret"] = ; ``` Note There will likely be two configurations, one for Elements and one for your [Application](https://namazustudios.com/glossary/application/). It will be necessary to add the same [Session](https://namazustudios.com/glossary/session/) secret to both of these. Adding this will automatically add the [Session](https://namazustudios.com/glossary/session/) token to any requests that require auth. Warning Most requests are [Profile](https://namazustudios.com/glossary/profile/) related, so we are not quite done with the login process yet. Now that the [Session](https://namazustudios.com/glossary/session/) secret for the [User](https://namazustudios.com/glossary/user/) has been acquired, we can either retrieve all of the Profiles for that [User](https://namazustudios.com/glossary/user/), or create a new [Profile](https://namazustudios.com/glossary/profile/). ### Create New [Profile](https://namazustudios.com/glossary/profile/) [#create-new-profile](#create-new-profile) Creating a new [Profile](https://namazustudios.com/glossary/profile/) will require a reference to the [Application](https://namazustudios.com/glossary/application/) that it's being created for. See [Users and Profiles](https://namazustudios.com/elementsmanual/web2/UsersAndProfiles/) for more information on the relationship structure. The **CreateProfileRequest** object used to create a new [Profile](https://namazustudios.com/glossary/profile/) contains the following properties: - UserId (Required) - ApplicationId (Required) - DisplayName (Required, can be changed later) - ImageUrl (Optional, can be changed later) The **CreateProfile** request will give you the created [Profile](https://namazustudios.com/glossary/profile/) object if the request was successful. Note It is possible to create a [Profile](https://namazustudios.com/glossary/profile/) with the signup request. If you have done this, and you only ever intend for the [User](https://namazustudios.com/glossary/user/) to have one [Profile](https://namazustudios.com/glossary/profile/) for your [Application](https://namazustudios.com/glossary/application/), then it's perfectly reasonable to cache the profileId somewhere and reuse it when assigning the [Session](https://namazustudios.com/glossary/session/) token to the headers. However, it's still a good idea to implement the next section as a backup in case the cache is cleared or the [User](https://namazustudios.com/glossary/user/) signs in from a different device. ### Fetch Existing Profiles [#fetch-existing-profiles](#fetch-existing-profiles) If someone has already created a [Profile](https://namazustudios.com/glossary/profile/) and simply wishes to log back in to that [Profile](https://namazustudios.com/glossary/profile/), then you can retrieve all profiles for a [User](https://namazustudios.com/glossary/user/) and [Application](https://namazustudios.com/glossary/application/) using the **GetProfiles** via the **ProfilesApi**. At this point it's up to you to decide whether to let someone choose their [Profile](https://namazustudios.com/glossary/profile/) (for example, if you have a game that allows for multiple characters) or to choose for them. ### Add [Profile](https://namazustudios.com/glossary/profile/) [id](https://namazustudios.com/glossary/id/) to Headers [#add-profile-id-to-session-key](#add-profile-id-to-session-key) Once the [Profile](https://namazustudios.com/glossary/profile/) has been acquired, to authenticate any [Profile](https://namazustudios.com/glossary/profile/) specific requests (e.g. Progress), the [Profile](https://namazustudios.com/glossary/profile/) [id](https://namazustudios.com/glossary/id/) can be added as a separate header: ``` C# Headers["Elements-ProfileId"] = ``` and with this, the login process is complete! Note Please review the [Sessions > Scoping Rules](../../core-features/sessions#scoping-rules) documentation to ensure you've provided the proper access levels to new users.