Authentication
Console sessions
Section titled “Console sessions”Signing in to the console creates an HttpOnly session. Console writes also send
the rotating CSRF token returned by GET /v1/auth/me.
API keys
Section titled “API keys”Bearer keys are shown once. Grant only the scopes an integration needs, rotate them from the console, and never place them in browser URLs.
Switching workspace
Section titled “Switching workspace”Switch the session workspace with POST /v1/auth/workspace and
{"workspace_id":"ws_…"}. Workspace identity cannot be overridden with a
caller-supplied query or header.