Security

Authentication

Use the authentication method defined by each API product. The products do not share one invented authentication scheme.

Public Embed API

Approved public routes are unauthenticated where safe and remain rate-limited and visibility-filtered.

Server-to-server requests use the implemented scoped key ID, timestamp, nonce, and HMAC signature headers.

Reseller portal operations use an authenticated SparkGlim session and enforce account membership and permissions.