What SPAPS Is
SPAPS is Sweet Potato’s hosted application control plane. It gives multiple applications one API for application identity, user authentication, payment state, wallet identity, entitlements, webhooks, secure messages, and audit-sensitive integration flows.
Downstream applications call SPAPS with provisioned credentials. A publishable key identifies a browser application; a secret key identifies a server-side application. Protected operations also check the caller’s session, role, and required capabilities. Application-bound sessions must match the selected application; global human sessions still undergo route-specific application checks.
SPAPS is proprietary hosted SaaS. Operator-prepared access provides API credentials and authorized clients. It does not include backend source, containers, database access, or deployment rights.
For enterprise customers, Sweet Potato may provide a managed arrangement. Sweet Potato still operates SPAPS; enterprise access does not turn SPAPS into a customer-hosted product.
What Your Team Owns
- Your application UI and server.
- Your application-specific authorization and product behavior.
- Safe storage of secret keys and precise browser-origin configuration.
- Staging-to-production promotion and integration testing.
What Sweet Potato Owns
- Hosting and operating the SPAPS backend.
- Application credential issuance and service availability.
- Shared identity, billing, entitlement, wallet, and integration contracts.
- Backend deployment, migrations, and operational controls.