Skip to Content
v1.5Official documentation for the LX CloudPos API · stable in production
v1.5 (current)Authentication and securityTenant isolation

Tenant isolation

Each API key operates exclusively on its own tenant. This is part of the defense-in-depth design: even if an API key leaks, the damage is contained to a single tenant.

  • An API key can only operate on its own tenant.
  • Data (products, customers, documents) is physically separated by PostgreSQL schema.
  • Even if an id_producto from another tenant is known, the API key will receive 400 Producto no encontrado.

There is no way to access cross-tenant resources via the API. The filter is applied at the persistence layer, not only at the application layer.

Connection securityURL structure