Authentication overview
Authentication overview
Identity and credentials
Identity describes the caller (user, organization or no identity); credentials prove it. Consult API Reference for each endpoint's supported identities, credentials and scopes.
| Credential | Header | Boundary |
|---|---|---|
| User OAuth access token | Authorization: Bearer | Represents an authorized user |
| Service access token | Authorization: Bearer | client_credentials; does not provide user identity |
| API key | X-API-Key | Must satisfy endpoint identity/scope requirements; secure backend only |
For user integration follow Authorization Code + PKCE, then read the profile using quickstart. Browser authorization and token exchange use the accounts issuer; business REST uses the API domain. Match environments.
Keep client_secret on secure backends; Public clients have no secret. Token expiry comes from expires_in. Validate state, minimize scopes and keep credentials out of logs.
See choosing authentication, OAuth overview, and API keys.