Skip to content

Authentication

Spendware uses separate credentials for management automation and runtime usage.

User API Keys

User API keys authenticate management API calls. They are appropriate for automation that creates projects, customers, pricing rules, billing resources, customer keys, and webhook endpoints.

Common management scopes include:

  • management:read.
  • management:write.
  • webhooks:read.
  • webhooks:write.
  • Domain-specific read scopes such as billing:read or account:read where required.

Management requests also pass RBAC checks. A scope allows an operation category, while RBAC controls access to the organization or resource.

Customer Keys

Customer keys authenticate runtime usage and preflight calls for one customer. Use them in provider adapters and direct runtime logging paths.

Recommended runtime scopes:

  • preflight:read.
  • usage:write.

Headers

Raw API calls use bearer authentication:

Authorization: Bearer SPENDWARE_API_KEY

Use SPENDWARE_CUSTOMER_KEY for runtime usage endpoints that are intended for customer-key authentication.

Secret Handling

Store keys in a secrets manager or environment variables. Do not log raw key values, Authorization headers, webhook signing secrets, or provider credentials. Customer and user key create responses may show the full key once; persist it immediately.