Authentication and browser sessions

Project keys

Create, list, and revoke keys in Projects & API keys. Store the one-time secret in a server-side secret manager. Revocation immediately invalidates child browser sessions.

Allowed origins are exact origins: scheme, hostname, and optional port. Paths, credentials, wildcards, and lookalike suffixes are rejected.

POST /api/v1/browser-sessions

Call this endpoint from your server with a project API key. The requested origin must exactly match the project allowlist. Child expiry, scopes, request budget, and concurrent-request limits cannot exceed operator ceilings or the parent key.

const response = await fetch(baseUrl + "/api/v1/browser-sessions", {
  method: "POST",
  headers: {
    Authorization: "Bearer " + process.env.SPZ_API_KEY,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ origin: "https://app.example", scopes: ["generate", "verify", "availability"] }),
});

CORS

Authenticated browser responses are no-store and return CORS headers only for the exact session origin. Credentials are not accepted in query strings or postMessage events.