Authentication

Authentication credentials are provided by Findustry AI and scoped to each account.

Authentication varies by integration:

• APIs with keys
• SDK with signed tokens
• Web hook callbacks with HMAC signatures

API

Server-to-server requests authenticate with a secret key passed in the Authorization header.

GET /apikey/validate
Authorization: sk_findustryai_kkkkkkkkkkkk_nnnn

Secret keys begin with sk_findustryai_ and end with an underscore and four characters. These are used as the identifier for your key and are not part of the secret material.

SDK

Embedded AI executes in the user application runtime (e.g., browser). This requires signing a time-restricted access token prior to initialization.

import { FindustryAI } from "@findustryai/embed";

const findustryAI = new FindustryAI({
  token: "eyJ…" // time-restricted access token signed by secret key
});

Tokens may be refreshed as need for the application environment. Long-lived tokens are not permitted.

Web Hooks

Web hooks are delivered with an HMAC signature in the X-Webhook-Signature header. The value begins with sha256= and is followed by the signature. The signature is calculated as HMAC-SHA256(secret, body). The secret is provided by Findustry AI during registration.

POST {{ platform_webhook_url }}
X-Webhook-Signature: sha256={{ signature }}

{{ body }}

Verifying the HMAC signature is recommended as a security best practice. In addition to verifying the signature, the inbound IP addresses may be restricted to all of the following: 3.220.86.193, 3.227.155.205, 18.214.229.184, 52.4.144.154.