Request Lifecycle
Application-scoped API requests identify the application. Protected user routes also validate the user’s session. Public discovery and provider-webhook routes have their own authentication rules.
Application Identity
The API key selects the SPAPS application. Browser requests use a publishable key and must match an allowed origin. Privileged server requests use a secret key.
User Identity
Routes that require a user validate the token and its current session authority. An application-bound token must match the application selected by the API key. Global human sessions remain subject to the selected application’s account-erasure and route-specific access checks.
Staging Identity
A staging application is a real hosted application boundary with separate credentials. Your app can run on a local or preview origin while calling the hosted API. Production uses another provisioned application rather than a runtime switch inside SPAPS.