Securing your origin

Your origin stays private

Agents only ever see your gw.superspice.xyz/g/... gateway URL. Your origin base URL is never exposed in the 402 terms, the catalog, or any response — the gateway proxies to it server-side. (Origins must be HTTPS in production, and can’t carry credentials in the URL.)

Headers you can trust

On every request the gateway forwards to your origin:

• Any x-superspice-* header the buyer sent is stripped — a caller can never assert a Superspice header at you.
• The gateway adds x-superspice-gateway: <your-slug> — so your logs can tell Superspice traffic apart.

On the way back, x-superspice-* headers from your origin’s response are reserved for the gateway’s own use (balance headers and friends), so there’s no collision.

The origin shield header

For real enforcement, set an origin secret on your endpoint. The gateway then attaches it to every forwarded request:

x-superspice-origin-secret: <your secret>

Configure your API (or your WAF/load balancer) to reject any request missing the correct value, and your origin now serves Superspice traffic only — every request that reaches your business logic has already passed the payment wall. Someone who guesses your origin URL gets a 401/403 from your own perimeter.

That’s the whole setup: one header check on your side, and the paid front door is the only door.