Web vs API Chain

This is the first concept to understand in SlaunchX.

The Split

Chain	Prefix	Primary auth	Primary caller
WEB	/web/v1/**	JWT, X-Client-Hash, optional Secure Channel	browser and portal clients
API	/api/v1/**	API key + HMAC	backend systems

Why This Matters

The same business domain can contain both WEB and API behavior, but the security model is not interchangeable.

If you call a WEB endpoint like an API endpoint, or vice versa, the request can fail before business logic runs.

Practical Rule

Use WEB when:

1. a human user is logged in through a portal
2. the request depends on portal context
3. the request depends on session fingerprinting
4. the request can require Secure Channel

Use API when:

1. a backend service owns the integration
2. the request is signed with API credentials
3. the endpoint is explicitly exposed for API-key access

403 Implications

WEB chain

403 often means one of these:

1. missing or invalid portal context
2. portal mismatch between entrypoint and token
3. session fingerprint mismatch
4. missing permission inside the active session

API chain

403 often means one of these:

1. the endpoint is not API-exposed
2. the API key lacks the required scope
3. access is denied by scope policy

Read Next

1. Portal Model
2. Authentication Models
3. Permissions and Scopes