Build against bounded, auditable business APIs.

Use server API keys for software you control or OAuth 2.0 Authorization Code with PKCE for delegated access. Every credential is limited by environment, business, scope, expiration, and current account permissions.

Scoped credentials

Secrets appear once, are stored only as protected hashes or encrypted envelopes, and can be rotated or revoked.

Signed delivery

Webhooks use HMAC signatures, timestamps, stable event IDs, bounded retries, dead letters, and explicit replay.

Installable monitor

The PWA keeps private data online-only, offers a public offline shell, and supports on-device alerts.

Authentication

Send exactly one credential. Server keys use the Alvanate header. Delegated clients use a bearer token. Responses are private and include an API version, request ID, and rate-limit headers.

X-Alvanate-Key: alv_test_...Authorization: Bearer alv_at_...

Live API keys require an approved application. Public OAuth clients cannot hold a client secret. Exact redirect URI matching, PKCE S256, state round-trip, one-time codes, rotating refresh tokens, and replay-family revocation are enforced.

Scopes

businesses:read

Business identity and operating status

monitoring:read

Activity, alerts, and performance summaries

money:read

Provider-confirmed financial summaries

orders:read

Orders and fulfillment status

products:read

Products, variants, availability, and verified media

webhooks:manage

Application webhook subscriptions

notifications:manage

Notification subscriptions

Versioned resources

Method	Path	Required scope
GET	`/api/v1/businesses`	`businesses:read`
GET	`/api/v1/businesses/{businessId}/monitoring`	`monitoring:read`
GET	`/api/v1/businesses/{businessId}/money`	`money:read`
GET	`/api/v1/businesses/{businessId}/orders`	`orders:read`
GET	`/api/v1/businesses/{businessId}/products`	`products:read`

OpenAPI document

Verify webhooks

Build the signed bytes as timestamp.event_id.raw_body, compute HMAC-SHA256 with the subscription secret, and compare in constant time. Reject stale timestamps and previously processed event IDs.

X-Alvanate-Id: <event-id>
X-Alvanate-Timestamp: <unix-seconds>
X-Alvanate-Signature: v1=<hex-hmac>
X-Alvanate-Api-Version: 2026-07-20

Recovery

Rotate compromised keys and secrets immediately; the previous value stops authenticating.

Failed deliveries retry with bounded backoff, then move to a dead letter that can be replayed after correction.

Revoking an app cascades to its credentials, grants, and subscriptions.