> ## Documentation Index
> Fetch the complete documentation index at: https://docs.papermap.ai/llms.txt
> Use this file to discover all available pages before exploring further.
# Backend Implementation
This guide provides an overview of implementing secure tenant dashboard management using HMAC signature authentication for enterprise-grade multi-tenant security.
## Architecture Overview
```
Your API (Tenant Management)
↓
HMAC Signed Request → Papermap Dashboard API
↓
Dashboard Created/Retrieved
↓
Generate Iframe Token (HMAC Signed)
↓
Frontend Embeds Dashboard
```
### Key Components
1. **TenantDashboard Model** - Maps tenants to Papermap dashboards
2. **HMAC Signature Service** - Securely authenticates API requests
3. **Dashboard Handler** - Creates dashboards and generates embed tokens
4. **Dashboard Router** - API endpoints for dashboard operations
## Quick Start
Follow these guides in order to implement the backend:
Implement HMAC signature authentication to securely communicate with the
Papermap API.
Learn how to implement HMAC-SHA256 signature authentication
Set up the ability to create and manage dashboards for your tenants.
Learn how to create dashboards via the Papermap API
Generate secure tokens to embed dashboards in your frontend.
Learn how to generate secure embed tokens
Create REST API endpoints for your frontend to interact with.
Example REST API endpoints for dashboard operations
Follow security best practices for production deployment.
Learn about security considerations and best practices
## Database Model
First, create a model to link your tenants to their Papermap dashboards:
It is not required to save it this way, but you need to have a way to map your tenant to their dashboards.
```python Python theme={null}
from sqlalchemy import Column, String
from .database import Base
class TenantDashboard(BaseModel):
__tablename__ = 'tenant_dashboards'
tenant_id = Column(String(255), nullable=False, index=True)
workspace_id = Column(String(255), nullable=False)
dashboard_id = Column(String(255), nullable=False)
```
```sql POSTGRESQL theme={null}
CREATE TABLE tenant_dashboards (
id SERIAL PRIMARY KEY,
tenant_id VARCHAR(255) NOT NULL,
workspace_id VARCHAR(255) NOT NULL,
dashboard_id VARCHAR(255) NOT NULL,
created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);
CREATE INDEX idx_tenant_id ON tenant_dashboards (tenant_id);
```
```sql MYSQL theme={null}
CREATE TABLE tenant_dashboards (
id INT AUTO_INCREMENT PRIMARY KEY,
tenant_id VARCHAR(255) NOT NULL,
workspace_id VARCHAR(255) NOT NULL,
dashboard_id VARCHAR(255) NOT NULL,
created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
INDEX idx_tenant_id (tenant_id)
);
```
**Purpose**: Links your tenant to a Papermap dashboard ID for secure access and isolation.
## Prerequisites
Before implementing, ensure you have:
* Papermap API credentials (API Key ID and Secret Key)
* Your workspace ID
* API endpoint URL (obtain from your Papermap dashboard settings)
**Security Best Practices:** - Never hardcode API endpoints, keys, or secrets
in your code - Always use environment variables or a secrets management system
* The API endpoint URL should be treated as sensitive configuration - Store
credentials securely and rotate them regularly
## Environment Configuration
Store your credentials securely in environment variables:
```bash .env theme={null}
PAPERMAP_API_KEY_ID=your-api-key-id
PAPERMAP_SECRET_KEY=your-secret-key-never-share
PAPERMAP_API_URL=
```
**Obtaining Your Configuration:** - **API Credentials**: Available in your
Papermap dashboard under **Settings → API Keys** - **API Endpoint**: Available
in **Settings → API Configuration** - Always use the values provided in your
dashboard for your specific workspace
## Implementation Guides
Implement secure HMAC signature authentication
Create and manage dashboards for tenants
Generate secure embed tokens
Build REST API endpoints
Track per-tenant credit consumption
Security best practices
Performance and scalability tips
## Common Pattern Reference
The HMAC signature pattern for tenant dashboards follows this flow:
```
1. Create Payload
payload = workspace_id + valid_until
2. Generate Signature
signature = HMAC-SHA256(payload, secret_key)
3. Send Request with Headers
X-API-Key-ID:
X-Workspace-ID:
X-Valid-Until:
X-Signature:
4. Store Result
tenant_id → dashboard_id mapping
5. Generate Embed Token
Encode {tenant_id, dashboard_id, signature, expires} as base64
```
This pattern ensures secure, time-limited access to tenant-specific dashboards.
## Next Steps
Learn how to embed dashboards in your frontend application