Authentication

Every route in the API is protected and requires authentication. Requests must include a valid API key in the headers to be processed.

Header	Required	Description
X-Key	Yes	A company-scoped API key issued by the platform.

How it works

1. The platform reads the X-Key header from the incoming request.
2. The key is securely validated to ensure it belongs to an active company account.
3. If the key is valid and active, the request proceeds.
4. If the key is missing, invalid, or revoked, the request is rejected immediately.

Auth Error Responses

HTTP Status	Condition	Response Body
401	X-Key header is absent	{ "error": "Unauthorized: Missing X-Key header" }
403	Key not found or revoked	{ "error": "Forbidden: Invalid or revoked API Key" }
500	Unexpected server error	{ "error": "Internal Server Error" }