Authentication

Bearer token (HTTP Authorization header)

Endpoints that require authentication accept a bearer token via Authorization.

curl -sS \
  -H "Authorization: Bearer $TOKEN" \
  https://api.example.tld/v1/me

Notes

Tokens should be scoped to a service and rotated periodically. If a token leaks, revoke and rotate instead of adding complex client-side workarounds.