AUTHENTICATION
Every protected request needs a trusted identity.
Hamiltonn Cloud separates end-user authentication, service credentials and platform authorisation so integrations can identify who is calling and what they are allowed to do.
Hamiltonn Cloud
Every protected request needs a trusted identity.
Hamiltonn API authentication establishes the identity of a user, service or integration before protected platform resources can be accessed.
Definition
What does this mean?
Hamiltonn API authentication establishes the identity of a user, service or integration before protected platform resources can be accessed.
Hamiltonn Cloud combines reusable software infrastructure, configurable product capabilities and flexible deployment so organisations can build around their own brand and operating model.
CONTEXTS
Different callers need different credential patterns.
End users
User sessions or user-scoped access for customer-facing experiences.
Server integrations
Protected service credentials for backend-to-backend workflows.
Administrative access
Higher-privilege access controlled separately from ordinary sessions.
SERVER SIDE
Keep privileged credentials out of public clients.
User
Interacts with the customer app.
Frontend
Sends the required user request.
Secure backend
Holds privileged integration credentials where required.
Hamiltonn API
Authenticates the call and resolves context.
Authorisation
Checks resource and action permissions.
Response
Returns only the permitted result.
TENANT CONTEXT
Authentication does not replace tenant isolation.
The platform must resolve the correct organisation below the frontend layer instead of trusting an arbitrary tenant identifier from client code.
CREDENTIAL HYGIENE
Credentials should be scoped, separable and replaceable.
- Use separate non-production and production credentials.
- Store secrets in protected server-side configuration.
- Revoke credentials that are no longer required.
- Rotate credentials through supported platform processes.
- Avoid logging full tokens or secrets.
NEXT
Authentication is one part of the integration boundary.
FAQs
AUTHENTICATION FAQs
Can I put a Hamiltonn API secret in browser JavaScript?
Privileged server-side credentials should not be embedded in public browser or mobile code.
Is authentication the same as authorisation?
No. Authentication identifies the caller; authorisation determines what that caller can do.
How is the correct tenant determined?
Tenant context should be resolved and enforced by platform services.
Should sandbox and production use the same credentials?
No. Environment-specific credentials keep testing and live operations separated.
Can credentials be rotated?
Supported credential-management processes should allow credentials to be replaced or revoked.
Build on Hamiltonn Cloud.
Choose the product, modules and deployment model that fit your business, then bring the customer experience under your own brand.