Authentication

Optimizely Graph supports multiple authentication methods, each designed for specific access levels and use cases.

You can group the available methods as follows:

• Admin access: Provides full access to all Graph resources without restriction.
  • HMAC
  • Basic
• Restricted access: Provides scoped access to specific resources based on identity and assigned roles.
  • HMAC + (cg-username and cg-roles headers)
  • Basic
  • Bearer (JWT)
• Public access: Provides read-only access to publicly available resources, such as published CMS
  • Single Key

Best Practices

• Use HTTPS in all requests.
• Prefer HMAC or JWT for secured production environments.
• Rotate single keys regularly and treat them as sensitive.
• Never expose secrets or tokens in front-end code unless you use a single key for public content.