API authentication boundaries
Understand session credentials, workspace API keys and connector authorization.
Reviewed against the implementation · September 25, 2026
Match credentials to the endpoint
Dashboard endpoints use the agent-session authentication and role checks shown in the Auth API. Supported automation endpoints use their documented workspace API key. A key accepted by one API surface is not a promise of access to every route.
Keep secrets off the website
Store API keys and provider credentials on your backend. The public widget embed does not need a private agent token. Avoid credentials in URLs, analytics events or logs.
Respect workspace permissions
Use the least-privileged role or scope that can perform the operation. Permission checks happen on the server. Do not infer authorization from an interface button being visible.
Expiry and revocation
Use the session expiry returned by authentication rather than a hard-coded lifetime. Re-authenticate expired sessions and revoke credentials that are no longer needed. See the current Auth and API-key guides for the supported management flows.