Authentication

API keys (Bearer)

Send protected requests with Authorization: Bearer <API_KEY> over HTTPS only. Keys are issued, rotated and revoked from the account settings and carry explicit scopes.

Browser sessions

Inside the platform, access tokens are short-lived (15 minutes) and refresh tokens (7 days) rotate on every use with reuse detection. Two-factor authentication (TOTP) is available from settings.

Inbound webhooks

Inbound triggers are defined in the platform with a per-trigger token and an optional signature to verify the source. See the triggers and webhooks groups in the reference.

Errors