Build a CRM on ServiceStack

This walkthrough builds a multi-tenant CRM on ServiceStack, secured end to end with B5 Secure. By the end you’ll have credential authentication, email verification, and contact management authorized by activity-based, data-aware authorization (ADA).

Step 1 — Install & register

Add the B5 Secure packages for ServiceStack and register the framework. Registration wires the security pipeline into the request lifecycle so every request is verified by default.

// Configure.cs (AppHost)
Plugins.Add(new B5SecurityKitFeature());

Step 2 — Credential-based authentication

Authenticate a user with their credentials and issue an identity token. B5 Secure validates the identity, applies IP-firewall and origin checks, and establishes the security context for the request.

Step 3 — Email verification

Mark accounts unverified until they confirm their email. The pipeline blocks protected actions for unverified identities automatically; use VerificationNotRequired to exempt the verification endpoints themselves.

Step 4 — Contact management with ADA

Protect your CRUD operations. With ADA, the authenticated identity must possess an explicit permit for this action and be permitted on this record — with almost no application code.

[Protect]
[Permission("contact.update")]
[AuthEntity(typeof(Contact))]
public object Put(UpdateContact req) { ... }

Step 5 — Interaction recording

Add a child entity (interactions logged against a contact) and extend ADA to it. This reinforces least privilege: a user who can read a contact may not be permitted to record interactions unless granted that permit.