Secure Programmatic Access: Product Gale Introduces API Credentials for Workspace Automation

Today, we are proud to announce the general availability of API Credentials, a new system that gives enterprises secure, scoped, programmatic access to their Product Gale workspaces. With API Credentials, external services, scripts, and automation pipelines can authenticate directly against the Product Gale API without relying on user sessions, browser-based login, or shared passwords.

For teams wiring Product Gale into their own systems (pipelines that kick off a scan after a catalog change, services that push product updates in, or dashboards that pull findings and leak figures out), API Credentials provide a purpose-built authentication mechanism designed from the ground up for machine-to-machine communication.

A note on naming: several scopes and event names below still read curation:* and taxonomies:*. Those are the literal identifiers the API uses today and they are documented here exactly as they behave. They cover the operations that analyse your products and generate corrected page content.

The Challenge: Bridging Human Authentication and Machine Access

Product Gale's platform has always supported robust user authentication through JWT-based sessions and enterprise SSO. But as organizations deepen their integration with Product Gale, a gap emerges: machines don't log in through browsers.

Consider the scenarios teams face daily:

• Automated Pipelines: A nightly job needs to kick off a scan and retrieve the findings, but JWT tokens expire after user sessions end
• External Integrations: A Shopify app or custom middleware needs to push product data into Product Gale, but can't authenticate through OAuth login flows
• Internal Tooling: Engineering teams build custom dashboards and monitoring scripts, but have no stable, long-lived authentication mechanism
• Third-Party Services: Workflow automation platforms like Zapier or Make need persistent credentials to call Product Gale APIs on behalf of a workspace

Without dedicated API credentials, teams resort to workarounds that compromise security:

• Shared User Accounts: Creating "service" users with real email addresses, violating the principle of individual accountability
• Token Extraction: Manually copying JWT tokens from browser sessions, which expire unpredictably
• Credential Sprawl: Passing personal credentials through environment variables, risking exposure
• No Granularity: User tokens carry full user permissions, making it impossible to restrict a script to read-only access

Enterprises need authentication credentials that are designed for machines: long-lived, scoped, auditable, and secure at rest.

The Solution: Workspace API Credentials

Product Gale's API Credentials system delivers exactly this. Create named credentials with specific permission scopes, receive a cryptographically generated secret key, and authenticate any HTTP client against the Product Gale API with a single header.

How It Works

1. Create a Credential

Navigate to the API Credentials page in your workspace. Click "Create API Credential" and configure:

• Name: A descriptive label for the credential (e.g., "Shopify Sync Service," "Nightly Scan Pipeline," "QA Dashboard")
• Scopes: Select exactly which permissions this credential should have, from individual operations like curation:read to wildcard access like taxonomies:*
• Expiration (Optional): Set an expiration date for credentials that should be time-limited, such as contractor integrations or temporary testing keys

2. Receive Your Secret Key

Upon creation, Product Gale generates a cryptographically secure secret key and displays it exactly once:

sk_a1b2c3d4e5f6...

This is the only time the plaintext secret is visible. Copy it immediately and store it in your secrets manager. The key is encrypted at rest using AES-256-GCM before being persisted, so even Product Gale cannot retrieve the original value after this moment.

3. Authenticate API Requests

Include the secret key in the Authorization header of any API request:

Authorization: ApiKey sk_a1b2c3d4e5f6...

The API validates the credential, checks that it's active and unexpired, verifies the requested operation falls within the credential's scopes, and processes the request. No cookies, no browser sessions, no token refresh flows, just a single, stable header.

4. Monitor and Manage

View all your workspace's API credentials in a clean dashboard interface showing:

• Credential name and assigned scopes
• Masked secret value (e.g., sk-****...****abc) for identification without exposure
• Last used timestamp, so you know exactly when each credential was last active
• Expiration status with clear warnings for approaching or passed deadlines
• One-click revocation for credentials that are no longer needed

Permission Scopes

API Credentials support granular, fine-grained permission scopes that map directly to Product Gale's workspace permission system. Each credential receives only the permissions it needs, nothing more.

Available Scope Groups:

Wildcard Support:

• Use prompts:* to grant all prompt-related operations
• Use * for full workspace access (use sparingly and prefer scoped credentials)

This granularity means a credential powering your read-only reporting dashboard never has the ability to modify data, and a credential used by your scan pipeline doesn't have access to member management.

Enterprise-Grade Security

API credentials hold access to your store and product data. Every aspect of the system is built with security as the primary design constraint.

AES-256-GCM Encryption at Rest

Secret keys are encrypted before storage using AES-256-GCM, the same encryption standard used by financial institutions and government agencies. Each credential generates a unique random initialization vector (IV), and an authentication tag ensures that encrypted values cannot be tampered with without detection.

The encryption key itself is managed through environment configuration (ENCRYPTION_KEY), separate from the database, following the principle of key separation.

One-Time Secret Display

When you create an API credential, the plaintext secret is displayed exactly once. It is never stored in plaintext, never logged, never included in API responses after creation, and never visible to any user again, including administrators. If a secret is lost, the credential must be revoked and a new one created.

This approach mirrors the security model used by industry leaders like AWS, Stripe, and GitHub for their API key management.

Constant-Time Comparison

When validating an incoming API key, the system uses constant-time string comparison to prevent timing attacks. Unlike standard equality checks that return early on the first mismatched character (leaking information about how much of the key matched), constant-time comparison always takes the same duration regardless of input, eliminating a common side-channel attack vector.

Automatic Expiration Enforcement

Credentials with expiration dates are automatically rejected after their deadline passes. The check happens at authentication time, requiring no background jobs or cleanup processes. Expired credentials cannot be reactivated. If access is still needed, a new credential must be created with a fresh secret.

Soft Deletion and Audit Trail

When a credential is revoked, its auditing data remains, preserving the audit trail. Administrators can see the full history of credentials that were created for a workspace, when they were last used, and when they were deactivated, supporting compliance requirements and security investigations.

Usage Tracking

Every successful authentication updates the credential's last used timestamp. This gives security teams immediate visibility into:

• Which credentials are actively in use
• Which credentials are dormant and may be candidates for revocation
• When a credential was last exercised, which is critical for incident response if a breach is suspected

Composite Authentication: JWT and API Key Side by Side

Product Gale doesn't force you to choose between user authentication and API key authentication. The platform's composite authentication guard seamlessly supports both mechanisms on the same endpoints.

This means:

• Human users continue authenticating through the web interface with JWT sessions and SSO, with full UI-driven workflows
• Automated services authenticate with API keys, calling the same API endpoints programmatically
• Mixed environments where both humans and machines interact with the same workspace work without any special configuration

The composite guard attempts JWT validation first and falls back to API key validation automatically. From the application's perspective, both authentication paths produce the same authorization context. The only difference is the source of the identity.

Role-Based Access Control

API Credential management is governed by Product Gale's role-based permission system:

This ensures that only authorized team members can create credentials that grant programmatic access to the workspace. Editors and viewers can see what credentials exist (for transparency), but credential lifecycle management remains in the hands of workspace administrators.

Real-World Use Cases

API Credentials unlock automation patterns that were previously impractical or insecure.

Automated Scan Pipelines

Create a credential with curation:* scope and integrate it into your CI/CD pipeline. When your catalog changes (from supplier feeds, inventory systems, or data imports), your pipeline can automatically kick off a fresh scan, monitor progress, and retrieve the findings, all without human intervention.

E-Commerce Platform Sync

Configure a credential with curation:read and taxonomies:read scopes for your Shopify or Magento integration. Your sync service reads the corrected product content from Product Gale and pushes it to your storefront on a schedule, or in response to webhook notifications.

Internal Analytics Dashboards

Issue a read-only credential (curation:read, taxonomies:read, prompts:read) to power internal dashboards. Growth and engineering teams get real-time visibility into open findings, monthly leak totals, and fix status, without granting the dashboard any ability to modify production data.

Third-Party Integrations

Provide a scoped credential to workflow automation platforms. An n8n, Make or Zapier integration can trigger a scan when a Google Sheet is updated, or post new findings to a Slack channel when a run completes, all authenticated securely through a dedicated API key.

Contractor and Partner Access

Create time-limited credentials with expiration dates for contractors or integration partners. When the engagement ends, the credentials expire automatically. No need to remember to revoke access. The system handles it.

Multi-Environment Development

Generate separate credentials for development, staging, and production environments. Each credential can have different scopes: broad access in development for testing, restricted read-only access in production for monitoring, ensuring environmental isolation without managing separate user accounts.

Getting Started

Setting up API Credentials for your workspace takes just a few minutes.

1. Navigate to API Credentials

Open your workspace and click "API Credentials" in the sidebar navigation. The management page displays all existing credentials and their status.

2. Create Your First Credential

Click "Create API Credential" and fill in:

• A descriptive name that identifies the credential's purpose
• The scopes the credential needs, selecting the minimum necessary permissions
• An optional expiration date if the credential should be time-limited

3. Secure Your Secret

After creation, the secret key is displayed once. Copy it immediately and store it in your secrets manager (HashiCorp Vault, AWS Secrets Manager, 1Password, etc.). This is the only opportunity to see the plaintext value.

4. Configure Your Client

Add the secret to your service's configuration:

# Environment variable
PRODUCT_GALE_API_KEY=sk_a1b2c3d4e5f6...

# HTTP header in requests
Authorization: ApiKey $PRODUCT_GALE_API_KEY

5. Verify and Monitor

Make a test API call and confirm authentication succeeds. Then check the API Credentials page. You should see the Last Used timestamp update, confirming the credential is working.

Best Practices

To get the most from API Credentials while maintaining strong security posture:

• Principle of Least Privilege: Grant each credential only the scopes it needs. A reporting service doesn't need curation:create. A sync tool doesn't need members:*.
• Descriptive Naming: Use names that identify the service and purpose: "Shopify Sync - Production," "Nightly ETL - Staging," "QA Dashboard - Read Only."
• Set Expirations Where Possible: For temporary integrations, contractor access, or testing credentials, always set an expiration date.
• Rotate Regularly: Periodically revoke and recreate credentials as part of your key rotation policy.
• Monitor Usage: Review Last Used timestamps regularly. Credentials that haven't been used in months may indicate orphaned integrations that should be cleaned up.
• One Credential Per Service: Avoid sharing a single credential across multiple services. Individual credentials provide better auditability and enable targeted revocation.

What's Next

API Credentials lay the foundation for Product Gale's programmatic access story. Looking ahead, we're investing in capabilities that extend this foundation:

• Credential Activity Logs: Detailed audit logs showing every API call made with each credential, including endpoints accessed and response codes
• Rate Limiting per Credential: Individual rate limits to prevent any single integration from consuming disproportionate resources
• IP Allowlisting: Restrict credential usage to specific IP ranges for an additional layer of access control
• Webhook-Triggered Credential Rotation: Automated notifications when credentials approach expiration, enabling proactive rotation workflows
• OAuth 2.0 Client Credentials Flow: For organizations that prefer standard OAuth flows for service-to-service authentication

Conclusion

Product Gale's API Credentials system brings enterprise-grade programmatic access to your scans, findings, and fixes. With AES-256-GCM encryption, granular permission scopes, one-time secret display, constant-time validation, and comprehensive audit capabilities, the system is built for organizations that take security seriously while demanding seamless automation.

Whether you're building automated scan pipelines, integrating with ecommerce platforms, powering internal dashboards, or enabling third-party services, API Credentials provide the secure, scoped, auditable authentication mechanism your machine-to-machine workflows require.

Secure by design. Scoped by default. Ready for production.

Product Gale is committed to giving ecommerce teams a clear view of how AI shoppers read their store, and the means to fix what they find. Our API Credentials system represents our continued investment in secure, extensible infrastructure that lets you integrate Product Gale into your operational ecosystem with confidence.