Authentication

Every request carries a bearer token in the Authorization header. Scopes decide what a token may do.

1. Bearer tokens

   Send your key as “Authorization: Bearer …”. Without a valid key you get a 401.

2. Scopes

   A token gets only the scopes you chose. A request outside them returns a 403.

3. Test and live

   Test keys never touch real data. Switch to live when you’re ready.

4. Limits, and what happens when you cross one

   There are two ceilings per key: one per minute and one per day. Cross either and you get a 429 with a Retry-After header saying how long to wait — the message tells you which ceiling you hit. A key that sits on its limit day after day gets looked at by a human and can be closed temporarily; you then get a 403 with the reason in it, so you know it is us and not your key.