Authentication

Intended model

The preview contract uses a bearer token over HTTPS. Future credentials are expected to be scoped to an approved organization and integration, with the minimum permissions needed for that workflow.

Authorization: Bearer <future-token>

The value above is a placeholder. Do not put a real secret into this site or its contact form.

Expected controls

credentials will never be accepted in query strings;
tokens will be stored and transmitted as secrets;
permissions will be narrow rather than manager-wide;
rotation and revocation will be part of the control plane;
write operations will use idempotency keys where retry safety matters.

These controls are design intentions for Phase 2, not claims about a running service.