u/Gojo055

Hello,

I'd like to suggest adding the ability to restrict API key permissions.

Currently, API keys are granted full access (I noticed the backend already returns "abilities": ["*"]). Being able to scope a key; for example making it read-only, or limiting it to specific folders, would give users much more flexibility in how they integrate with the API, and significantly improve security by following the principle of least privilege.

Since the abilities field already seems to exist in your backend, is scoped/granular permission support something you're planning to expose?

Thanks!

Drime already supports rclone, which is great. But their Vault feature (for encrypting files) isn’t integrated with it at all.

So you end up with this split:

• Vault => gives you the provider’s encryption
• rclone => gives you flexibility, tons of backends, and its own encryption (crypt)

But you can’t actually combine them.

If you go the Vault route, you lose rclone entirely. If you go the rclone route, you’re not using Vault anymore, you’re relying on rclone’s encryption instead.

That means you’re forced to choose between:

• Vault’s security model
• rclone’s ecosystem and convenience

And importantly, you can’t do layered encryption (Vault + rclone), even if you wanted to, because Vault simply isn’t accessible through rclone.

That’s the real limitation.

What feels missing is a way to:

• use Vault’s encryption
• access it through rclone
• optionally layer rclone’s own encryption on top in a controlled way

Right now, none of that is possible without completely switching approaches.

Native integration would turn this from a forced tradeoff into something actually flexible.

Curious if others have run into this, or if there’s something I’m missing.