> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://tieback.io/docs/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://tieback.io/docs/_mcp/server.

# Minting Security

> The security model behind minting: authenticated control plane, role based access, isolated scan resolution and privately stored export artefacts.

## Authentication

Every minting mutation requires an authenticated session. Anonymous or public execution of the minting control plane is disallowed.

## Role based access

| Operation                    | Required role                              |
| ---------------------------- | ------------------------------------------ |
| Submit mint request          | Admin or Owner                             |
| View batches, tokens, events | Any authenticated member with brand access |
| Generate exports             | Admin or Owner                             |
| Download export packs        | Any authenticated member with brand access |

## Control plane isolation

The minting control plane (job submission, batch management, export generation) is separated from scan resolution. That separation gives you three guarantees:

* Minting operations cannot be triggered from a public scan.
* Scan resolution runs with minimal privileges and exposes no minting controls.
* No minting mutation is publicly callable.

## Scan resolution security

* Scans capture aggregate telemetry with coarse geolocation. No consumer account is required and no personal profile is built.
* Bot traffic is detected and served static responses without recording telemetry.
* Activation changes are validated and access controlled, so a public scan cannot alter a unit's activation state.

## Export security

Export artefacts are stored privately and access controlled:

* Only members with brand level access can request and download exports.
* Downloads use short lived signed URLs that expire automatically.
* No permanent public URLs are created for export artefacts.

## Idempotency protection

Idempotency keys prevent duplicate job creation from repeated submissions, so a replayed or retried request cannot create unintended minting activity.

## Concurrency safety

Exclusive job locking during background processing means:

* Only one worker processes a given job at a time.
* No duplicate tokens or serial numbers are generated under concurrent load.
* Partial progress survives a worker failure.

## Related Docs

* [Minting Architecture](/minting/architecture)
* [Minting Lifecycle](/minting/lifecycle)
* [Security Architecture](/getting-started/security-architecture)