Skip to main content
Authenticate server-to-server API requests with:
Bearer credentials resolve directly to one organization. Resource authorization then checks scopes using <resource>:read for GET/HEAD and <resource>:write for mutations. Invalid or missing credentials return 401 UNAUTHORIZED. A valid credential without the required resource scope returns 403 FORBIDDEN. Session-cookie authentication exists for interactive identity and organization-management routes, but application integrations should use organization credentials.