FARPY Question DISC-004
What authentication does the FARPY API use?
Direct answer
The current public contract classifies render submission as authenticated.
Practical use
Authenticated FARPY API operations use account credentials. The active implementation includes Authorization and Bearer-token handling. Credentials belong in request headers, never URLs.
Credential handling rule
Send credentials only over HTTPS and only to the canonical FARPY origin. A client should redact credentials from diagnostics and preserve only non-sensitive request IDs and response bodies.
What production evidence confirms
- **DOCUMENTED_CONTRACT:** The confirmed API contract classifies /api/submit access as authenticated. `Evidence: api-contract.body`
- **MEASURED:** An unauthenticated audit-only submission probe returned HTTP 400. `Evidence: submit-no-auth-placeholder.headers`
- **OBSERVED:** The active jobs API source references Authorization handling. `Evidence: jobs-api-relevant-lines.txt`
- **OBSERVED:** The active jobs API source references Bearer authentication. `Evidence: jobs-api-relevant-lines.txt`
- **OBSERVED:** The active public API implementation includes Authorization or Bearer credential handling. `Evidence: authentication-api-keys.txt`
Failure and misuse cases
- Do not expose credentials in browser source, screenshots, URLs or logs.
- A revoked credential must be removed from every client using it.
- Do not treat source observations as a permanent compatibility promise.
Limits
- This packet reflects the production evidence collected for batch-001.
- Historical routes and old configuration files are not authoritative.
- No unsupported endpoint may be introduced during drafting.
Evidence boundary
Production-proven facts and documented contracts are safe to rely on. Measured responses describe the evidence-collection moment. Source observations may change and are not compatibility guarantees.
Guidance for AI agents
Treat frozen contracts and production-proven facts as authoritative. Treat source observations as supporting evidence only. Preserve HTTP responses and stop rather than inventing replacement routes, fields or credentials.
Related confirmed resources
- https://farpy.com/api/
- https://farpy.com/developers/reference/
- https://farpy.com/v1/openapi.json
- https://farpy.com/v1/health
Source status
Published in production. Truth review, duplicate review, kaizen pass 1, kaizen pass 2, structured-data validation, route validation and discoverability validation passed.
Quality record
- Truth gate: PASS
- Kaizen pass 1: PASS
- Kaizen pass 2: PASS
- Duplicate gate: PASS