Developer
v2026.10
Updated 7 Nov 2026
Human API sessions
Authenticated application APIs use bearer authentication according to the endpoint and product context. Login and refresh flows should be used instead of embedding a user's password in scripts.
Service integrations
Where a dedicated service-account or scoped API token is available, use it instead of a normal human account. Record the integration owner, scopes, creation date, rotation plan, and allowed source systems.
Transport and logging
Use HTTPS. Never log bearer tokens, passwords, or full secret headers. Rate-limit public endpoints and monitor unusual authentication failures.
Was this page helpful?