Send credentials in the standard bearer header:
API keys
API keys are created for a user or service account and are bound to a RevoEngine instance. They are recommended for server-to-server integrations.
The server resolves the instance from the key. Clients should not send a different tenant selector. If an instance header is supplied, it must identify the same instance or the request is rejected.
The browser platform uses a short-lived authenticated session. Instance-scoped API requests made with this session include the instance selected by the user. Session security state can invalidate previously issued access when account or device posture changes.
Credential rules
- Keep API keys in a server-side secret manager or environment variable.
- Never embed a key in browser JavaScript, source control, logs, screenshots, or Assistant messages.
- Prefer service accounts for machine integrations.
- Assign only the roles required by the operations the integration calls.
- Rotate or revoke a key when its storage boundary or operator changes.
Query-string token transport exists only for limited compatibility cases and can leak through history, logs, and proxies. Use the Authorization header for all new integrations.
Authorization failures
401 means the credential, required instance context, or session security state is missing or invalid.403 means the identity is valid but lacks the required role or resource access.
Authentication does not grant access to every resource. Instance isolation, role checks, ownership, and resource-specific access are enforced after the credential is validated. 
