Authentication

All calls are authenticated with a shared token plus an IP whitelist, in both directions.

Token

Requests carry an Authorization header with the token Wundermart issues to you. Wundermart sends the same token when it calls your Order endpoint, and your endpoint must verify it.

Authorization: Token <your-token>

Treat the token like a password. Never publish it or put it in client-side code.

IP whitelist

You give Wundermart one list of IP addresses, and it's used in both directions:

• Wundermart only accepts calls from addresses on the list.
• Wundermart only sends an order if your Order endpoint's hostname resolves to an address on the list.

If you call us from one address and host your endpoint on another, list both. Your endpoint must in turn only accept calls from the IP address Wundermart gives you.