> ## Documentation Index
> Fetch the complete documentation index at: https://developer.upsun.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Workload authorizations

> An authorizations list that grants applications and tasks narrowly-scoped access to the environment API and task operations.

Upsun Cloud runs several types of workloads — applications, workers, crons, and tasks. The `authorizations` key enables a workload to call the
Upsun Cloud API at runtime using short-lived, narrowly-scoped tokens, with no long-lived credentials required.
This key can be declared on both applications and tasks, but serves a different purpose depending on where it's declared:

* On an **application**: grants permission to trigger tasks and call the environment API.
* On a [**task**](https://developer.upsun.com/docs/configure-apps/tasks.md): grants the task permission to call the environment API from inside its container. A task can also trigger another task.
* On a [**worker**](https://developer.upsun.com/docs/configure-apps/image-properties/workers.md): inherits the application's `authorizations` by default, or overrides them — the same as other application properties
  that can be set in a web or worker instance (such as `relationships`, `mounts`; for a complete list, refer to the **Set in instance** column of the
  **Primary application properties** table in the [single-runtime](https://developer.upsun.com/docs/configure-apps/app-reference/single-runtime-image.md#primary-application-properties)
  and [composable image](https://developer.upsun.com/docs/configure-apps/app-reference/composable-image.md#primary-application-properties) topics).
* On a **cron**: crons run inside the application container and inherit its `authorizations` automatically. You cannot grant different authorizations to individual crons.

The `authorizations` key grants an application or task permission to make specific calls to the Upsun Cloud API from inside its container.
Each authorization defines a `type` and an `action`, and optionally a `resource` to scope the permission.

No user API token or long-lived credential is required.
The platform injects a short-lived bearer token at runtime, scoped to the permissions declared here.

## How it works

Instead of storing a long-lived API token in your environment, every application and task container has a local auth proxy running at `http://localhost:8200`.
The proxy issues short-lived tokens scoped to the permissions you declared — so there are no credentials to rotate, and a token issued in one environment cannot act on another.

When your code needs to call the Upsun Cloud API:

1. Your app sends a token request to `http://localhost:8200/oauth2/token`.
2. The proxy returns a bearer token scoped to those declared permissions.
3. Your app uses that token to call the Upsun Cloud API.

## Parameters

| Parameter | Values | Description |
| :- | :- | :- |
| `type` | `task`, `env` | The type of resource to access: `task` — a task defined in your project. `env` — the environment API. |
| `resource` | Task name | The name of the task. Required when `type` is `task`. |
| `action` | `operate`, `view` | `operate` allows triggering and managing a task. `view` grants read-only access to the environment API. |

### Valid combinations

| `type` | `action` | `resource` | What it grants |
| :- | :- | :- | :- |
| `task` | `operate` | Task name | Trigger and manage the named task |
| `env` | `view` | — | Read-only access to the environment API |

## Examples

Allow an application to trigger a task and read the environment API:


    applications:
      myapp:
        authorizations:
          \- type: task
            resource: myagent
            action: operate
          \- type: env
            action: view

Allow a task to read the environment API:


    tasks:
      myagent:
        authorizations:
          \- type: env
            action: view


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.