Security

Bootstrapware RFQ security

A publishable key identifies the workspace and applies CORS. It does not prove the end user may read or bid. Your server mints the author token after it checks the real session.

Secret keys stay on the server. Never put bsw_live_sec_ or bsw_test_sec_ in the browser, NEXT_PUBLIC_*, logs, or MCP snippets.
Author tokens use prefix bsw_rfqauth_v1. and header x-bootstrapware-author-token. Default lifetime is 300 seconds. The widget never mints a token.
Assigning a supplier id in browser input is never authority. The backend rechecks invitation and membership so a removed supplier does not keep access solely through token lifetime.
Allowed origins supplement authentication. They do not replace it. Details: origins.
Webhooks are HTTPS only and signed. Payloads carry ids, not private bodies, prices, or file URLs.
MCP configures apps. It does not list RFQs or accept quotes. Live and secret key mint stay on the dashboard.

See identity, API keys, and privacy.