Authentication

Intended model

The draft uses a bearer token over HTTPS. A future token would belong to one approved company and connection, with only the permissions needed for that job.

Authorization: Bearer <future-token>

The value above is only an example. Never put a real password or token into this website or its contact form.

Expected controls

credentials will not be accepted in a URL;
tokens will be treated as secrets in storage and in transit;
each connection will receive only the permissions it needs;
tokens will be replaceable and revocable;
requests that change data will be designed so a safe retry does not create duplicates.

These are plans for the future API, not claims about a service that is already running.