Authentication Reference¶
Raw API requests use bearer tokens. The token value can be a user API key, a customer key for specific runtime endpoints, or a JWT for dashboard-compatible flows.
Authorization: Bearer SPENDWARE_API_KEY
Credential Types¶
| Credential | Use For | Common Scopes |
|---|---|---|
| User API key | Management automation | management:read, management:write, webhooks:read, webhooks:write |
| Customer key | Runtime preflight and usage logging | preflight:read, usage:write |
| JWT | Dashboard/session-compatible calls | User session permissions |
Management APIs check both key scope and resource RBAC. Webhooks management checks webhooks scopes plus organization or endpoint role.
Secret Safety¶
- Keep keys server-side.
- Store full keys in a secrets manager.
- Log only key prefixes.
- Never expose customer keys in browsers unless the endpoint is explicitly designed for that trust model.