Authentication & Access Control
LiteAPI implements strict authentication and access control mechanisms to ensure that only authorized users and systems can access its APIs and internal systems.
API Authentication Model
Access to LiteAPI is authenticated using API keys issued per customer account.
Key characteristics:
- Each API key uniquely identifies a customer and environment
- API keys must be included in every API request
- Requests without valid credentials are rejected
API keys are designed for server-to-server usage and must not be exposed in client-side applications.
Environment Separation
LiteAPI maintains logical separation between environments, including:
- Sandbox / test environments
- Production environments
API keys are environment-specific and cannot be used across environments. This reduces the risk of accidental access to production data during development or testing.
API Key Management
Customers can manage their API keys through LiteAPI tooling or support channels.
Supported practices include:
- Key rotation without service interruption
- Immediate key revocation if compromise is suspected
- Use of multiple keys to separate applications or use cases
LiteAPI recommends rotating API keys periodically and whenever there is a suspected security incident.
Access Control Principles
LiteAPI follows the principle of least privilege for both customer-facing and internal access:
- Customers are granted only the access necessary to use the services
- Internal access to production systems and data is restricted to authorized personnel
- Access is reviewed periodically and revoked when no longer required
Internal Authentication Controls
Internal access to LiteAPI systems is protected using:
- Strong authentication mechanisms
- Role-based access controls
- Secure access pathways to production environments
Administrative access is logged and monitored.
Credential Storage and Handling
LiteAPI:
- Stores credentials in encrypted form
- Never exposes secret values in logs or monitoring tools
- Avoids sharing credentials via insecure channels
Customers are responsible for securely storing API keys within their own systems, such as environment variables or secure secret management solutions.
Customer Responsibilities
Customers are responsible for:
- Protecting API keys from unauthorized access
- Ensuring credentials are not embedded in client-side code or public repositories
- Rotating keys according to their internal security policies
Updated about 21 hours ago