Send Authorization: Bearer <access_token> on every request. The SDKs exchange your personal API key automatically; direct HTTP callers must first exchange the key. The credential selects the organization, and resource access follows the owner's current permissions intersected with the key's action and workspace limits.

Authentication failures use a different error surface from the data plane — application/problem+json with an absolute type URI. Those are documented under problem codes.