Credentials
Authentication and API-key handling
Every customer route requires one UrTheProduct bearer key. The key is a secret capability scoped to a purchased package—not a user login and not a general provider credential.
Key format
Authorization: Bearer utp_live_PUBLIC_IDENTIFIER.SECRETThe visible structure helps route verification, but every character is sensitive. The server stores a permanent HMAC, not a recoverable raw key. A temporary encrypted reveal copy exists only for the purchase session and is deleted after confirmation or ten minutes.
Where the key may be stored
| Location | Allowed? | Reason |
|---|---|---|
| Server environment or secret manager | Yes | Available only to trusted backend code. |
| CI/CD encrypted secret | Yes | Use only for controlled deployment or tests; mask output. |
| Password manager backup | Yes | Required because UrTheProduct cannot recover the raw value. |
| Browser JavaScript, mobile bundle, desktop bundle | No | Users can inspect bundled or runtime values. |
| URL, query string, form action | No | URLs leak through history, proxies, analytics, and referrers. |
| Logs, screenshots, support forms, chat | No | These systems retain and redistribute content. |
| localStorage, sessionStorage, non-HttpOnly cookie | No | Browser scripts and extensions can read the credential. |
Correct browser architecture
- The browser calls your own authenticated backend route.
- Your backend validates the signed-in user and business rules.
- Your backend reads
URTHEPRODUCT_API_KEYfrom its secret environment. - Your backend calls UrTheProduct and returns only the minimum result your UI needs.
Never call UrTheProduct directly from a client component. CORS is not a secret-protection mechanism.
Scope and rejection cases
A valid key is still rejected when it is expired, depleted, revoked, suspended, used with the wrong operation, or connected to a paused package. Wrong-operation use returns 403 forbidden; invalid or inactive credentials return 401 unauthorized; provider safety pauses return 503 provider_unavailable.
Leak response and rotation
- Stop sending the compromised value.
- Contact UrTheProduct support with the order reference and safe request IDs—never the key.
- Revoke the compromised key in administration.
- Issue or purchase a replacement according to the package policy.
- Update every server secret and redeploy.
- Review logs for unauthorized use and remove any retained key value.