Security & Authorization
Authentication, scoped credentials, and enterprise directory controls for SpendGuard workspaces.
Tokenized Credentials
SpendGuard utilizes high-entropy tokens that serve as pointers to authorize financial actions. Actual bank credentials or primary Stripe/Plaid keys stay inside vaulting and provider-token workflows.
Key Management Roadmap
Sensitive keys are encrypted and scoped today; production KMS/HSM enforcement remains launch evidence for hardened deployments.
Encrypted Transit
Hosted SpendGuard endpoints use HTTPS. Additional network controls depend on the customer deployment configuration.
Authentication Flow
Use a scoped bearer credential for management API requests. Keep service keys outside source control and grant only the permissions required by the integration.
Content-Type: application/json
SCIM Directory Setup
Create a dedicated SCIM token from organization settings, then configure the identity provider with the base URL and bearer token below. SCIM tokens are organization-scoped and separate from MCP service keys.
Authorization: Bearer <SCIM_TOKEN>
Supported directory operations include user provisioning and deprovisioning, role-backed groups, bounded equality filters, deterministic sorting, one-based pagination, and group membership PATCH operations. Bulk requests, password changes, and ETags are not advertised.