Authentication and key rotation

Every Partner API operation uses a tenant-scoped API key in X-API-Key. The key authenticates a backend service, not an end user, and must be loaded only from a server-side secret store.

Operating rules

• Store keys encrypted and restrict access to the calling service.
• Send keys only in HTTPS headers, never as query parameters.
• Redact X-API-Key from APM, error reporting and reverse-proxy logs.
• Use distinct keys per environment; a sandbox key is never a production key.
• Rotate the calling service first, verify the new key, then revoke the old key during the agreed overlap window.