Authentication Overview

When users enter their payment information into your revops.js application they are submitting sensitive financial and personal data. To keep this data secure and confidential, the RevOps platform requires that all revops-js requests be authenticated with an API key or access token. The method that you use will depend on the task you want to accomplish.

The two authentication methods currently supported by revops-js:

Method	Security	Use Cases
API Key	Long lived public API key	Publicly accessible user account creation pages
JSON Web Token (JWT)	Limited scopes and lifetimes	Updating payment instruments, Viewing instrument data

The API key method is suitable for account creation pages or onboarding flows that are public, e.g., freemium service onboarding. Your public API key has a limited scope and cannot be used to access data or perform operations beyond those required to create new accounts.

For all other use-cases, you can use a short-lived JWT with additional scopes to access data and perform extended operations, e.g., update payment instrument information. Since these access tokens let you operate over sensitive information, RevOps will generate short-lived tokens that are restricted in scope.