BUILD
Authentication
Use access tokens, API keys and service credentials safely.
Last updated July 19, 2026 · 6 min read#Bearer tokens
Protected platform endpoints accept RS256-signed JWT access tokens through the Authorization header. Interactive sessions use short-lived access tokens and protected refresh cookies.
http
Authorization: Bearer <access_token>#API keys
API keys are intended for server-to-server automation. Scope them narrowly, store them in a secret manager, and rotate them on a schedule.
http
X-API-Key: <api_key>Keep credentials server-side
Never embed an API key in browser code, mobile bundles, logs, screenshots or support tickets.
#Permissions and tenant context
- Authentication establishes identity; authorization is evaluated separately
- Roles aggregate granular resource permissions
- Entitlements determine which suites and capabilities are licensed
- Sensitive actions can require segregation-of-duties checks and approval
#Authentication errors
| Status | Meaning | Action |
|---|---|---|
| 401 | Missing, expired or invalid credential | Refresh or replace the credential |
| 403 | Authenticated but not permitted | Review scopes, role and entitlement |
| 429 | Rate limit exceeded | Back off and honor Retry-After |
Was this page helpful?