Authentication
The public API uses bearer authentication.
Requests act on the authenticated workspace. When a request cannot be authenticated or authorized, the API returns an error response with an error string.
Keep API tokens server-side. Do not embed tokens in browser code, mobile apps, or public documentation examples.