Authentication Summary
Match each API surface to its credential and team context
The full credential matrix and security guidance live in Authentication and Credentials.
| Surface | Header |
|---|---|
| Team or partner backend | x-api-key: <key> |
| Interactive or embedded user | Authorization: Bearer <token> |
Team-scoped product operations use x-team-id when the credential can access
more than one team. Partner-scoped collections such as GET /teams and
GET /apps do not select one managed team.
Bulk source data is submitted through the product API batch endpoints with the same credentials as every other operation. See Batch Imports.
Keep long-lived secrets on a trusted backend. See Team Context and Base URLs.