Header format
Use an Authorization header with a Bearer token.
Authorization: Bearer YOUR_API_TOKEN
Content-Type: application/json
Security rules
- Store tokens in a secret manager.
- Never expose tokens in frontend code.
- Rotate tokens when a teammate leaves.
- Scope tokens to the organization that owns the data.
Failure handling
Treat 401 as invalid authentication, 403 as missing permission, and 429 as a signal to slow down and retry later.