Every API request requires an Authorization: Bearer <token> header. Tokens are
scoped to your project (and on Enterprise, scoped further to specific permissions like read-only,
orders-only, etc.). Tokens never expire automatically; rotate them via the admin dashboard.
Rate limit: 1,000 requests per minute per token on Professional, 10,000/min on Enterprise.
Rate-limit headers (X-RateLimit-Remaining) accompany every response.