Local security model
Local by design. Explicitly paired.
The printer stays on the local machine or network. Every web application must be approved before it can send jobs through the Portix.One Runtime.
Runtime bound to the documented local interface
The Runtime listens on http://127.0.0.1:17321 — a loopback address, not a public one. It is not designed to be reachable from the public internet.
Explicit application pairing
Every web application must complete the pairing flow below before it can send a single print job. There is no default, always-on credential a stranger's app can reuse.
Revocable authorization
A completed pairing can be revoked from the Runtime at any time. Once revoked, that application's token stops working on its very next request.
No public printer exposure
The printer itself is never addressed directly by the browser. Every job passes through the Runtime, which is the only thing that talks to the printer.
Documented local data flow
Web application → SDK/API → local Runtime → printer, with status and errors flowing back the same path. No step in that chain is undocumented or hidden.
The pairing flow
- 01 The application calls POST /pairing/request with { tenant, appId } and receives a { code, expiresAt }.
- 02 A human approves the request from the Portix.One tray on the machine running the Runtime — this step cannot be automated or skipped.
- 03 The application polls GET /pairing/status?code={code} until status is "approved" (returns a token) or "expired".
- 04 The returned token authenticates every subsequent request via the x-portix-api-key header.
One documented exception: a pairing request from a browser origin the Runtime already trusts —
localhost or a private-network address — is approved automatically,
without a human in the tray. Every other origin, including a deployed production site, always requires a
human to approve the request from the Portix.One tray.
Token scope
A paired application's token only ever sees its own tenant and app's jobs — not every job the Runtime has ever queued. The Runtime's own admin key, used by the local dashboard and tray, is a separate credential that never leaves the machine it runs on.
Revocation
Revoking a pairing is immediate — the revoked application's token is rejected on its very next request. There is no delay, cache, or grace period.
Questions about a specific deployment or threat model? Email us — or read the Runtime API reference for the exact endpoints this page describes.