Authentication

The API surface (everything under /v1) is authenticated with an API key, not a session or JWT. Pass it as a bearer token:

Authorization: Bearer sk_test_ab12cd34...

Test vs. live mode

The key's prefix (sk_test_ / sk_live_) determines its mode, and that mode is enforced on every request — a test key is force-routed to simulated devices regardless of which vendor a connected account claims, and can never read or write live data. There is no way to accidentally leak test activity into production or vice versa.

Key lifecycle

Keys are created and revoked from the dashboard, not the API — issuing credentials is a human-in-the-loop action. A revoked key stops working immediately; there is no grace period.

Errors

A missing, malformed, unknown, or revoked key returns 401 Unauthorized with the standard error envelope described in Errors & rate limits.