Guide
Authentication Models
Product credentials, native public-client identity, customers, developer sessions, partner keys, and signed webhooks.
SoundSync
Do not interchange credentials
| Model | Use | Boundary |
|---|---|---|
| Developer account/session | Dashboard and permissioned workspace operations | Not distributed plugin credentials |
| Product key/secret | Standard custom HTTP and HISEScript integration | Product-scoped, not customer ownership proof |
| Native public-client identity | Supported hise-native / juce-native generated clients | App/product identification is not a secret and does not itself grant entitlement |
| Customer login / library proof | Customer identity, owned products, and authorized browsing | Not a developer dashboard token |
| Partner Bearer key | Approved external order/product/license operations | Server-side, scoped to the approved relationship |
| Webhook signature | Verify provider/partner event authenticity | Not an interactive user login |
Standard product credential path
Custom HTTP and HISEScript normally use x-ss-app-id, x-ss-plugin-key, and x-ss-plugin-secret with the intended product configuration. Use the endpoint's documented body/header aliases only when supported. Keep secrets out of URLs, logs, public screenshots, and frontend page source.
Rotation/revocation can affect shipped clients. Coordinate updated packages and customer binaries before retiring credentials used by an existing release.
Native package identity is a different path
The current middleware recognizes generated hise-native and juce-native public-client requests using the configured app/product identity. Do not add a shared secret to native public configuration merely because an older custom-HTTP example shows one.
Customer proof, entitlement, machine state, and supported validation/library proof still govern access. A public product ID or native-client marker is not permission to activate someone else's serial or open their library.
Endpoint evidence
An operation map gives methods and scope, not every request schema. Use the detailed contract for its actual fields, errors, idempotency, and fixture evidence. This source review does not replace seeded request/response testing.