Authentication

Portal access

Use Authorization: Bearer <portal_token> for human-facing routes.

API access

Use X-Client-Id and X-Client-Secret for machine-to-machine routes.

Rotate and revoke keys from the portal. Show the secret only once at creation time.