Authenticate API requests

Bearer token

Send the API token in the Authorization header for every public v1 request.

Store tokens in a secrets manager or protected environment variable and rotate them if exposed.

Authorization: Bearer API_TOKEN

Request security

Use HTTPS and call the API from trusted backend code.

Do not include tokens in URLs, logs, analytics events, client bundles, or support screenshots.

Unauthorized responses

A 401 response means the token is absent, invalid, or no longer authorized.

Confirm the Bearer prefix, token value, and team ownership before generating a replacement token.