Authenticate publishing, not public reads.

Bearer authorization

Authorization: Bearer {publish-key}

Bearer authorization is the recommended form and is used by the GitHub Action. The publishing service also accepts:

x-api-key: {publish-key}

Key checks

For each request, the service:

1. applies an IP rate-limit bucket when a client address is available
2. parses the public key prefix
3. looks up the hashed key record
4. verifies the token
5. checks revocation and publish scope
6. checks that the key’s app slug matches the route
7. applies the verified-key rate-limit bucket
8. updates the key’s last-used time

Rate-limit headers

Authenticated publishing responses include:

ratelimit-limit: 120
ratelimit-remaining: 119
ratelimit-reset: 42

The deployment can override the default limits. ratelimit-reset is seconds until the current 60-second fixed window ends. A 429 response also includes retry-after.

Dashboard authentication

Dashboard routes use the signed-in Accounts session and active organization. Session-backed /api/dashboard/* routes are UI implementation, not an alternative customer API.