Authentication

Send your tenant API token in the Authorization: Bearer YOUR_API_TOKEN header on every request. This is an opaque token, not a JWT. Query-string tokens are not supported.

A missing or invalid token can produce HTTP 401 from the authentication guard or HTTP 403 during tenant resolution. Keep tokens on your server and out of public client code.