Authentication and scopes

APICenter authenticates backend services with service-specific credentials. The service is registered in one project, and its allowed scopes and dependencies are managed in the Registry.

Use the SDK for service authentication

The recommended TypeScript client obtains and refreshes the APICenter bearer token. Configure the service ID, environment, and secret as server-only values:

import { ApiCenter } from '@alpha-explora/apicenter-sdk';

const api = new ApiCenter({
  baseUrl: process.env.APICENTER_URL!,
  auth: {
    serviceId: process.env.APICENTER_SERVICE_ID!,
    environment: process.env.APICENTER_ENVIRONMENT as 'test' | 'live',
    secret: process.env.APICENTER_SERVICE_SECRET!,
  },
});

Do not send the service secret to a browser or include it in mobile client code. Store distinct test and live credentials in the backend's secret manager. See SDK integration for installation and request examples.

For an integration that cannot use the TypeScript SDK, the service can request a bearer token directly with POST /api/v1/auth/token. See the token API reference. The SDK performs this exchange and token rotation for you.

Authorization

APICenter resolves the service's project and tribe from its registry placement. Callers cannot select a different project by changing token claims or request fields. The gateway checks the registered service, environment, required scopes, and shared-service dependencies before proxying a request.

Request only the scopes the service needs. If a request returns an authorization error, ask an operator to review the service registration and its project-level policy.

Payment credentials

The SDK uses the payment credential issued for the service and environment. A payment API key can be supplied when the platform provisions one; otherwise the service token must have the scope required by the operation. The exact payment scope depends on the resource and method. Do not reuse a credential across environments or services.

Human access to Management

Management sign-in is separate from service authentication. A user signs in with an authorized Google account and needs membership in the organization. Ask an organization administrator to add your email if sign-in reports that you do not have APICenter access. See Access and tenancy.