Authentication and Authorization¶
API keys¶
Create restricted API keys per environment and backend service. Supply the key as a bearer token:
Keys grant scopes such as catalog:read, pricing:read, and exports:write. A key cannot access a user's wishlist or alerts.
OAuth 2.0¶
Use Authorization Code with PKCE for user-facing apps. The authorization endpoint is https://auth.steamdeals.example/oauth/authorize; token endpoint is https://auth.steamdeals.example/oauth/token. Request narrowly scoped consent, for example wishlist:read alerts:write notifications:read.
Access tokens are JWTs with a 15-minute lifetime. Refresh tokens rotate on use and are valid for 30 days unless revoked. Validate iss, aud, expiry, and scope at your resource server.
Authorization¶
The gateway evaluates both token scope and resource ownership. An alert is accessible only to its user_id; organization members may use a service key only for organization-scoped exports. A failed scope check returns 403 insufficient_scope, not 404.
Never expose secrets
API keys and refresh tokens are credentials. Do not put them in mobile applications, static sites, logs, URLs, or WebSocket query parameters.