Endpoint security

Out-of-the-box security features

Basic authentication

Spryker offers built-in support for Basic Auth on both REST and Glue APIs. You can configure it to restrict access to sensitive endpoints or entire services.

IP whitelisting

Spryker allows you to set up IP allowlists at the web server (for example Nginx) or infrastructure level (for example AWS Security Groups, Cloudflare rules) to limit access to known, trusted sources.

HTTPS enforcement

While not specific to Spryker, it is recommended (and often defaulted via infrastructure) to serve all APIs over HTTPS to encrypt data in transit.

Best practices for secure integration endpoints

Use token-based authentication

Prefer OAuth2 or API keys with expiration and rotation over Basic Auth for better control and traceability. Glue APIs can be extended to support token-based schemes.

Limit access scope

Apply the principle of least privilege: expose only the endpoints and data required for the specific integration.

• Create custom API roles for partners with fine-grained access control.

Logging and monitoring

• Log all API access errors with details (timestamp, IP, headers, payload).
• Monitor unusual patterns and set up alerts for suspicious behavior.

Input validation and sanitization

Ensure all incoming data is strictly validated to prevent injection attacks or malformed payloads.