Authentication

All API calls use Bearer authentication.

Authorization header

Authorization: Bearer YOUR_TOKEN

Secure storage

• Do not embed the token in frontend JavaScript.
• Store it in an environment variable or secret manager.
• Do not write it to application logs.
• Use separate credentials for test and production.

Invalid token

{
  "error": 1,
  "message": "Token is not valid"
}