Authentication

Authenticate each integration by its credential:

• API requests with secret keys
• SDK sessions with publishable keys or signed access tokens
• Web hook callbacks with HMAC signatures

Administrators may create keys in the Findustry AI Portal, under the user menu › Settings › Developers.

API

Server-to-server requests authenticate with a secret key in the Authorization header.

GET /apikey/validate
Authorization: sk_findustryai_kkkkkkkkkkkk_nnnnn

Secret keys begin with sk_findustryai_. The four or five characters after the final underscore identify the key and are not secret.

Hostnames

SDK

Public Sessions

Public sessions, such as the Embedded Payments SDK, open with a publishable key. Publishable keys begin with pk_findustryai_ and are safe to include in pages.

import { FindustryAI } from "@findustryai/js";

const findustryAI = new FindustryAI({
  publishableKey: "pk_findustryai_live_…"
});

Manage allowed origins in the Findustry AI Portal, under the user menu › Settings › Developers.

Authenticated Sessions

Authenticated sessions, such as the Embedded AI SDK, open with an access token signed by a secret key.

import { FindustryAI } from "@findustryai/js";

const findustryAI = new FindustryAI({
  token: "eyJ…" // time-restricted access token signed by secret key
});

Sign a time-restricted access token on the server before initialization. Renew tokens as the application environment requires. Long-lived tokens are not permitted.

Web Hooks

Web hooks include an HMAC X-Webhook-Signature header. The value is sha256= followed by the signature. The signature is HMAC-SHA256(secret, body). Findustry AI provides the secret during registration.

POST {{ platform_webhook_url }}
X-Webhook-Signature: sha256={{ signature }}

{{ body }}

Findustry AI recommends verifying the HMAC signature.

Findustry AI uses the following outbound IP addresses:

• 3.220.86.193
• 3.227.155.205
• 18.214.229.184
• 52.4.144.154