Authentication

Every protected API request uses a short-lived bearer token:

Authorization: Bearer <access_token>

How you receive that token depends on who is connecting.

API keysBest for your own backend, scripts, and server-side workflows.

OAuthBest for an approved partner app connecting on a customer's behalf.

Choose	When	Token care
API key	Your team is connecting your own account	Exchange the key for a one-hour access token; exchange again before it expires
OAuth	A partner app is connecting a customer’s account	Use the one-hour access token and the accompanying refresh token

Access is limited by scopes, so each connection gets only the capabilities it needs.