Bearer API keys
Send your key in the Authorization header over HTTPS. Do not include it in query strings.
Authorization: Bearer YOUR_API_KEYPermissions and tenant boundaries
Keys are associated with an organization. Read-only keys cannot perform writes. Access can also be limited by the key's configured IP allowlist, expiration and revocation state. Your integration cannot select another tenant by supplying a tenant identifier.
Key management remains private
Create, rotate and revoke keys from the authenticated API Keys settings. Use a separate key per integration, avoid sharing production keys with developers, and revoke a key immediately if it is exposed.
MCP authentication is different
For AI clients, follow the MCP OAuth guide. MCP permissions and approval policies apply to MCP connections; do not assume they replace REST API key controls.