Authentication and scopes
Use the authentication mode selected by the customer profile: tenant machine-to-machine, user-delegated or bound actor. The API edge applies tenant and profile policy; partners and ISVs should not bypass it by calling internal engines.
Token handling
Store {{API_TOKEN}} only in an approved runtime secret store. Do not send it to browser clients, package it in a bundle or place it in logs. Create separate credentials for each environment and integration. Rotate or revoke a token when its owner, environment or permitted scope changes.
Request only required scopes, such as chat, embeddings, models or product MCP.