Skip to main content

Authentication

The PrintPrice API uses authenticated access to protect platform services and ensure safe integration with external systems.

Authentication requirements may vary depending on the endpoint type, but the main goal is consistent access control.

Objectives​

Authentication exists to:

  • restrict access to authorized clients
  • protect production data
  • prevent abuse
  • enforce integration boundaries
  • support auditability

Supported Authentication Models​

Typical integration models may include:

  • API keys
  • server-to-server authentication
  • internal service authentication
  • signed webhook verification

Different models may be applied depending on the risk profile of the endpoint.

API Key Authentication​

For most server-side integrations, API key authentication is the most straightforward model.

A client includes a secret key in the request headers.

Example header:

Authorization: Bearer YOUR_API_KEY

The API validates the key before processing the request.

Typical authentication headers include:

  • Authorization
  • X-API-Key
  • X-Admin-Api-Key

The exact header convention should remain stable across environments.

Security Principles​

Authentication should follow these principles:

  • never expose secret keys in frontend code
  • rotate keys periodically
  • scope keys by environment where possible
  • reject missing or invalid credentials deterministically
  • log authentication failures safely

Unauthorized Requests​

When authentication fails, the API should return a structured error response.

Typical cases include:

  • missing credentials
  • invalid credentials
  • expired credentials
  • insufficient privileges

Example response pattern:

  • ok: false
  • error: UNAUTHORIZED
  • message: Authentication failed

Environment Separation​

Production and non-production environments should use separate credentials.

This reduces the risk of accidental cross-environment access and improves operational control.

Internal Service Security​

Where multiple internal services communicate, authentication should also apply between trusted services.

This helps protect:

  • pricing services
  • preflight services
  • orchestration endpoints
  • admin workflows

Webhook Verification​

Webhook endpoints should not rely only on source IP trust.

Recommended verification patterns include:

  • shared secret signatures
  • timestamp validation
  • replay protection
  • strict payload verification

Best Practices​

Recommended implementation practices:

  • store secrets in environment variables
  • avoid committing credentials to the repository
  • use HTTPS only
  • rate-limit sensitive endpoints
  • monitor repeated authentication failures

Long-Term Direction​

As the platform expands, authentication may evolve toward more granular models such as:

  • partner-scoped credentials
  • role-based access
  • signed requests
  • tenant-aware access policies

These patterns become increasingly important as PrintPrice grows into a multi-party production platform.