Authentication

API keys are the only public auth model

Public automation requests must be authenticated with an organization-owned API key. Session cookies and Better Auth references are private implementation details and are not part of the public contract.

Recommended header

Authorization: Bearer <api_key>

Fallback header

x-api-key: <api_key>

Auth model

API keys belong to organizations, not individual users.

The organization context is resolved directly from the key, so you do not send a separate organization or workspace header.

Scope checks run after the key is validated. If a key is valid but under-scoped, you will receive a `403 FORBIDDEN` response.