A public information board at a dam, a city hall lobby, or a visitor center needs to let anyone walk up and see live station data. It does not need — and cannot safely have — a login screen. Nobody is going to type a password on a shared touchscreen bolted to a wall, and if they could, that credential would belong to everyone who ever stood in front of it.
The naive fixes both fail for the same reason: a shared "public" account with real credentials is one screenshot away from being reused somewhere it should not be, and full admin access dressed up with a friendlier UI is still full admin access. What the kiosk actually needs is not authentication at all. It needs a bounded grant of access that expires, that cannot escalate, and that never touches a password field.
We built exactly that for Wodowskaz: scanning a QR code on a public board drops a visitor straight into a live, sandboxed view of the local stations — no login, no visibility into anything outside that scope.
A Capability, Not an Identity
Most access control starts from the same question: who is this user? For a public kiosk, that question has no useful answer — there is no user, just a physical device anyone can walk up to. The right question is different: what is this specific link allowed to see, and until when?
That reframing is the whole pattern. Instead of issuing an identity and checking its permissions on every request, we issue a signed URL that carries its own permissions with it — a capability token, not a login. An administrator picks a scope (one station, one region, one demo dataset), sets an expiry, and the platform generates a link. Whoever holds that link can do exactly what it grants and nothing else, for as long as it is valid, without ever proving who they are.
How the Grant Actually Works
The URL parameter is a signed, tamper-evident token — not a database ID that happens to look random. It encodes the resource scope and an expiry timestamp, and it is signed server-side so that changing a single character invalidates it instead of silently granting access to something else.
When the link is opened, the server verifies the signature, checks the expiry, and provisions a session scoped to exactly what the token allows — nothing from the admin panel, nothing from other stations, nothing from user management. The visitor never sees a login form because there is nothing to log into: the URL itself is the credential, and it is worthless for anything the token was not explicitly signed for.
This is deliberately not OAuth and not a shared API key. OAuth solves "prove who you are to a third party" — there is no third-party identity to federate here. A shared API key embedded in a public, physical location is a leak waiting to happen, and revoking it breaks every other kiosk using the same key. A signed, scoped, expiring URL sidesteps both problems: it needs no identity provider, and revoking one kiosk's access never touches another.
The Operational Side: One Panel, Many Public Endpoints
The security pattern only earns its keep if generating and managing these links is trivial for the people running the deployment, not just the engineers who built it. In practice, that means an admin screen where a non-technical operator picks a scope, sets a time-to-live, and gets back a QR code and a copyable link — ready to print, laminate, and bolt to a board at the next site visit.
For an integrator running kiosks across dozens of public sites, this turns access control from a recurring engineering request into a five-second admin task. A demo link for a trade show, a permanent link for a dam's visitor center, and a 48-hour link for a press event are all the same mechanism with a different scope and expiry — no code changes, no new deployment, no shared password to eventually rotate.
The mistake most platforms make with public-facing access is treating it as a weaker version of admin login. It should not be a version of anything — it is a different problem, with a different shape, that a password was never designed to solve. Scoped, signed, expiring URLs give you exactly the access surface a public kiosk needs and nothing it doesn't. It is the same instinct behind serving public data without exposing the platform that generates it: decide what the outside world is allowed to see, and build the narrowest possible door for it. See the full flow in the Wodowskaz case study.
