Authentication

Handle Ultrafield API keys safely: scope credentials to a single project, keep environments and workloads isolated, and rotate without downtime.

Ultrafield API access uses credentials issued for machine-to-machine requests. The exact key format and management surface are provided with early access.

Handle credentials as secrets

  • Keep keys on the server. Never embed them in browser or mobile application bundles.
  • Load keys from your deployment platform's secret store.
  • Use different credentials for development, staging, and production.
  • Rotate a key when a team member leaves, a system is decommissioned, or exposure is suspected.
  • Avoid writing request headers or raw keys to logs.

Separate workloads

Use distinct credentials where separate revocation, usage visibility, or operational ownership matters. A production streaming service should not need to share a credential with a one-off evaluation script.

Failed authentication

Treat an authentication failure as a configuration or credential-lifecycle problem. Do not retry it indefinitely. Confirm the environment, credential status, and base URL before issuing another request.

See Errors and retries for retry guidance.

On this page