Authentication

Every data-plane request requires a project API key in the Authorization header:

Authorization: Bearer strent_test_your_opaque_secret

curl https://api.strent.dev/v1/active_items/list \
  --request POST \
  --header 'Authorization: Bearer strent_test_your_opaque_secret' \
  --header 'Content-Type: application/json' \
  --data '{"stripe_customer_id":"cus_123"}'

Security boundary

The key selects and authenticates one Strent project. It does not authenticate your application’s user and does not prove that a user may access a Stripe Customer or application resource.

Keep API calls on your server:

1. Authenticate the application user.
2. Authorize the user against your own account or resource.
3. Resolve the account’s trusted stripe_customer_id.
4. Call Strent with the server-held project API key.
5. Combine the returned billing fact with your application policy.

Key lifecycle

• Give each consuming server a recognizable key.
• Store secrets in a managed secret store.
• Create a replacement before revoking an old key.
• Revoke a key immediately when it may have been exposed.
• Never log the full key or include it in client-visible diagnostics.

Create a project API key →