Authentication & organization access
Understand permanent keys, temporary sessions and origin checks.
- 01
Permanent API keys belong on partner servers and are passed as Authorization: Bearer credentials.
- 02
Temporary widget sessions are origin-bound and expire after ten minutes. Revoking the issuing key invalidates its sessions.
- 03
Authenticate your own customer before issuing a session. Determine endUserId from verified identity, never an arbitrary customer-supplied ID.
- 04
Widget session requests require the approved parent origin; the SDK handles the parent-origin header.
- 05
Keep organization roles, retail access and site-wide privileges separate.