Authentication
Every request carries a bearer token in the Authorization header.
Authorization: Bearer axs_live_7Hq2…Token types
| Type | Use for | Lifetime |
|---|---|---|
| API key | Server-to-server integrations | Until revoked |
| OAuth access token | Acting on behalf of a user | 1 hour |
| Refresh token | Getting new access tokens | 90 days, rotated on use |
Failures
A missing or invalid token returns 401 unauthorized. A valid token without the required scope returns 403 forbidden and names the missing scope in error.details.scope.