# nixbuild.net Expands Biscuit Token Usage with Signed Build Links and Access Policies

DevFeed: [nixbuild.net Expands Biscuit Token Usage with Signed Build Links and Access Policies](<https://devfeed.tech/articles/biscuits-and-web-links-34141.md>)

Original publisher: [Read original article](<https://blog.nixbuild.net/posts/2023-09-22-biscuits-and-web-links.html>)

Author: support@nixbuild.net

Published: 2023-09-22T00:00:00Z

Content type: release

Language: en

Sources: [nixbuild.net blog](<https://devfeed.tech/sources/nixbuild-net-blog.md>)

Topics: [API](<https://devfeed.tech/topics/api.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [Nix](<https://devfeed.tech/topics/nix.md>), [builds](<https://devfeed.tech/topics/builds.md>), [GitHub](<https://devfeed.tech/topics/github.md>), [Command-line interface](<https://devfeed.tech/topics/cli.md>)

Tags: [api](<https://devfeed.tech/tags/api.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [authorization](<https://devfeed.tech/tags/authorization.md>), [build](<https://devfeed.tech/tags/build.md>), [cli](<https://devfeed.tech/tags/cli.md>), [github-action](<https://devfeed.tech/tags/github-action.md>), [http](<https://devfeed.tech/tags/http.md>), [ssh](<https://devfeed.tech/tags/ssh.md>), [web](<https://devfeed.tech/tags/web.md>)

## AI overview

The article announces expanded use of Biscuit authorization tokens in nixbuild.net. It describes signed links for accessing build details and logs, advanced access policies, and token-based SSH authentication, with tokens restricted by permissions, expiration, and build-specific scope.

## Source excerpt

About one year ago, we introduced an HTTP API for nixbuild.net. This API can be used to retrieve information about the builds you've run on the service. One place where the API is used is in the GitHub Action nixbuild-action to create detailed build summaries at the end of workflow runs. When the API was launched, it was using Biscuit auth tokens to handle authentication and authorization. In the initial implementation, we didn't really take much advantage of Biscuit, and basically used them as plain API keys. This week, however, we've finally expanded our Biscuit usage to properly take advantage of the flexibility offered. Read on to find out how this allows us to now support advanced access policies, token-based SSH auth and signed web links that gives easy access to build logs and fancy build reports. Signed Web Links Let's start out with the feature we're really happy to launch: signed web links. To show how it works, I grep for a broken package in nixpkgs and find one called textpieces. Then I try building it on my laptop which has been setup to use nixbuild.net as a remote builder (we need NIXPKGS_ALLOW_BROKEN=1 and --impure in order to force Nix to evaluate the broken package): $ NIXPKGS_ALLOW_BROKEN=1 nix build --impure nixpkgs#textpieces error: build of '/nix/store/s7ns32ymdf9iq44hpa62dkdbwlhvc7nx-textpieces-3.4.1.drv' on 'ssh://eu.nixbuild.net' failed: builder for '/nix/store/s7ns32ymdf9iq44hpa62dkdbwlhvc7nx-textpieces-3.4.1.drv' failed with exit code 1 error: builder for '/nix/store/s7ns32ymdf9iq44hpa62dkdbwlhvc7nx-textpieces-3.4.1.drv' failed with exit code 1; last 10 log lines: > upgrade: Use the '$' extern syntax introduced in blueprint 0.8.0 > at ../resources/ui/CustomToolPage.blp line 43 column 3: > 43 | .TextPiecesToolSettings tool_settings { > | ^ > error: Cannot convert 2.5 to integer > at ../resources/ui/Editor.blp line 45 column 26: > 45 | margin-bottom: 2.5; > | ^ > ninja: build stopped: subcommand failed. > [nixbuild.net] See this link for bui