Authentication and Authorization

this guide provides an overview of user authentication and authorization, along with their primary methods while you can use the upstart commerce apis directly for experimentation, we recommend you go through the general concepts to enhance your development experience authentication authentication is the process of verifying the identity of a user or system it serves as the initial gateway to access upstart commerce apis unlike the conventional username and password method, our platform employs a more secure approach by authenticating users through api keys and session ids this enhances the overall security of the apis and adds an extra layer of protection, which safeguards sensitive interactions authentication methods there are four distinct authentication methods tailored for upstart commerce apis authentication and authorization docid\ yyjjpm03u2skspcoxc8ch authentication and authorization docid\ yyjjpm03u2skspcoxc8ch authentication and authorization docid\ yyjjpm03u2skspcoxc8ch authentication and authorization docid\ yyjjpm03u2skspcoxc8ch 1\ api key an api key is a unique identifier that ensures secure authentication and authorization for upstart commerce apis it enables controlled access, tracks usage, and validates requesters by serving as a secret token this key is the authentication mechanism for users with upstart portal accounts, enabling them to invoke both management and consumer apis to generate an api key through our apis, go to the management apis docid 1lhevqdsqqbptuwxosj8o guide 2\ session id the session id is a unique identifier assigned during user authentication in upstart commerce it tracks user interactions, manages sessions, facilitates features like authentication and personalization, and offers an alternative method for making api calls the session id serves as the authentication mechanism for users with nochannel portal accounts and is not intended for consumers to generate a session id through our apis, go to the session id docid\ p1ufdvhvkgxp7lfzdimzp guide 3\ anonymous bearer token the anonymous bearer token is designed for users who prefer to explore sites without the need to log in this method allows users to interact with upstart consumer apis, enabling them to build an anonymous user experience for the storefront site to generate an anonymous bearer token through our apis, go to the anonymous bearer token docid\ qr7k yfbaxlavtwpckpgw guide 4\ logged in bearer token a logged in bearer token is given to the customer during the transition from an anonymous state to a registered state this token allows users to explore advanced functionality and features available exclusively to registered users to generate a logged in bearer token through our apis, go to the logged in bearer token docid\ smkwegcviyf2xj eesoqg guide authorization authorization determines whether a user has the necessary permissions to perform a specific action or access upstart commerce apis during user creation within the upstart commerce platform, roles are associated with users according to their specific needs these roles come with predefined sets of permissions that authorize users to access specific endpoints for detailed information on authorization, go to the roles and permissions docid 65qcvhohhyuapsey9j8t guide