How it works

Adminmate is made of two parts that communicate in a secure way:

• the Dashboard, hosted by Adminmate at app.adminmate.io;
• the Data API, hosted by you, next to your database.

Dashboard

app.adminmate.io

The UI your team uses. Hosted by Adminmate in the EU.

encrypted

Your infrastructure

Data API

Node.js · your servers

Checks the master password and the permissions of each request.

Your database

SQL or MongoDB

Queried through Sequelize or Mongoose. Never copied, never stored by us.

Note

You keep full control over your data and over who can access it. Adminmate never stores the content of your database.

The Data API

The Data API is an Express router provided by an npm package (adminmate-express-sequelize or adminmate-express-mongoose). It exposes the endpoints the Dashboard needs under the /adminmate/api path: list, read, create, update and delete records, run your actions, compute charts and export CSV files.

It uses your own Sequelize or Mongoose models, so it knows your schema, your relationships and your business logic.

What happens when you open the Dashboard

1. You log in to app.adminmate.io with your Adminmate account.
2. The Dashboard asks for the master password of the environment you open. Your browser sends it directly to your Data API, which checks it and returns a session token valid for 7 days.
3. From then on, your browser calls your Data API directly to read and write data. Each request carries the session token and permission tokens signed by Adminmate, which tell the Data API what your team is allowed to do.

Because the browser talks to the Data API directly, the Data API must be reachable from the browsers of your team (see Deployment). Adminmate servers only store the configuration of your project: environments, teams, layouts, dashboards, comments and the activity log (who did what, when, on which records — never the values of your data).

Credentials

The Data API is protected by four values you find in its configuration:

Value	Role
projectId	Identifies your Adminmate project.
secretKey	Given by Adminmate when you create the project. Used to verify the permission tokens issued by Adminmate.
authKey	A random key, generated at installation, used to sign the session tokens of your Data API.
masterPassword	The password you choose. Required to open the Dashboard on this Data API. Never sent to Adminmate servers.

On top of that, you can restrict access to a list of IP addresses with authorizedIps. See Data security.