X-API-Key header. GET /health is the only public operation.
Need a credential? Follow API Key Management before continuing.
Send the API key
Select a tenant
An API key may include one or more tenants. Where documented,X-Tenant-ID selects one tenant that is already inside the key’s scope.
X-Tenant-ID never grants access. It only narrows the scope already assigned to the key.Authentication flow
Credential failures
Credential handling rules
Secret storage
Secret storage
Store the key in a managed secret store or protected environment variable. Restrict read access to the integration runtime.
Logging
Logging
Never log the complete key. Log the returned
X-Request-ID, operation, status, error code, and a non-secret internal credential label.Rotation
Rotation
Create and verify a replacement key before deactivating the old credential. See Rotate API keys.
Client boundary
Client boundary
Do not expose the key to browser code, mobile applications, shared workstations, or customer-controlled scripts.
