API authentication (session vs API key)

The API authorizes calls two ways.

• Session cookie — when you're signed in to the app, the same session authenticates API calls from your browser. Org-scoped endpoints also require a member role.
• API key — for programmatic, server-to-server use. A key is bound to a specific organization and role; pass it as a bearer token. Programmatic API access is a Business+ capability.

Public endpoints (like the health check and the help center) need no authentication at all. Org-scoped endpoints return 401 when unauthenticated and 402 when your plan doesn't include the capability. There is no separate username/password for the API — keys (or your session) are the credential. Treat API keys like passwords: store them in a secret manager, scope them to the least role that works, and rotate them if exposed.