Authentication
API keys and account sessions have different responsibilities.
Language API keys
Language POST operations require Authorization: Bearer YOUR_API_KEY.
GET /v1/health requires no credential. Keys delegate api.invoke, not
organization administration. Expired or revoked keys cannot invoke operations.
Rotate by creating a new key, updating your server, verifying it works, then revoking the old key. Revocation is irreversible; plaintext secrets cannot be retrieved later. Never log authorization headers.
Account sessions
The console uses verified account sessions. Credentials and optional Google or GitHub sign-in identify users; dynamic organization roles and permissions determine access. A role's name is not its authorization policy.
Platform routes reject language API keys. Mutations require the exact configured console Origin for CSRF protection. Use the console's same-origin API reference with its session cookie; do not copy cookies into an SDK.
Testing with Scalar
Your API deployment exposes Scalar at /docs and Swagger at /swagger. Use a
scoped key there for language calls. The console exposes /api-reference for
session-protected platform calls; select its same-origin /v1 server.
This public documentation site is read-only and does not proxy API requests or collect keys. Use your deployment's reference to execute requests. Do not send credentials to an unfamiliar host.