Platform

API keys

Issue scoped credentials for server-to-server access.

Key handling

A plaintext key is shown only once. The database stores its prefix and cryptographic hash. Revocation and expiry are checked on every request.

Issue the narrowest scope set and apply endpoint-specific rate limits.