Authentication

Bearer token

All requests must include your API key in the Authorization header:

Authorization: Bearer <your-api-key>

Key scopes

Scope	Description
read	Read-only access to all endpoints
write	Create and update resources
admin	Full access including key management

Rotating keys

API keys should be rotated at least every 90 days. Generate a new key before revoking the old one to avoid downtime.

IP allowlist

You can restrict an API key to a set of CIDR blocks in the portal key settings.