Endpoint security

This document describes how to protect Spryker API endpoints at the infrastructure level. These measures complement the OAuth 2.0 authentication and authorization described in Authenticating and authorization—use them as an additional layer of defense, especially for integration endpoints exposed to third parties.

Basic authentication

Spryker offers built-in support for Basic Auth on its API endpoints. You can configure it to restrict access to sensitive endpoints or entire services.

IP whitelisting

Spryker allows you to set up IP allowlists at the web server (for example Nginx) or infrastructure level (for example AWS Security Groups, Cloudflare rules) to limit access to known, trusted sources.

HTTPS enforcement

While not specific to Spryker, it is recommended (and often defaulted via infrastructure) to serve all APIs over HTTPS to encrypt data in transit.

Best practices for secure integration endpoints

Use token-based authentication

Prefer OAuth2 or API keys with expiration and rotation over Basic Auth for better control, traceability and security. Spryker APIs support token-based schemes out of the box.

Limit access scope

Apply the principle of least privilege: expose only the endpoints and data required for the specific integration.

• Create custom API roles for partners with fine-grained access control.

Logging and monitoring

• Log all API access errors with details (timestamp, IP, headers, payload).
• Monitor unusual patterns and set up alerts for suspicious behavior.

Input validation and sanitization

Ensure all incoming data is strictly validated to prevent injection attacks or malformed payloads.