Authentication

The external REST API authenticates with admin-issued API keys sent in the X-API-Key header (not an app login token):

GET /api/v1/employees HTTP/1.1
X-API-Key: <your-api-key>

Each key is bound to one organization and a set of scopes. The secret is shown exactly once at creation and is never stored in readable form, so copy it right away. Revoked or expired keys are rejected, every route requires its own scope (default deny), and usage is rate limited per key.