Security
Authentication
Use private API keys or reviewed OAuth grants without exposing workspace credentials.
Private API keys
API keys inherit the creating member's workspace boundary and approved access. Keep keys server-side, rotate them when ownership changes, and revoke unused credentials.
OAuth
Partner applications use authorization code flow with PKCE, exact redirect validation, resource indicators, workspace-bound grants, scoped access, refresh rotation, and revocation.
Next
REST API