Authentication - Farelint

API-key provisioning is planned. No production keys are issued by this documentation site.

Proposed authorization

The target API uses a bearer token in the Authorization header. Do not put keys in URLs, front-end bundles, screenshots or logs. Store credentials in your server’s secret manager.

Authorization: Bearer YOUR_FARELINT_API_KEY
Content-Type: application/json
Idempotency-Key: YOUR_UNIQUE_REQUEST_ID

YOUR_FARELINT_API_KEY is a placeholder. A production base URL and credentials will be supplied when your pilot is activated.

Scope and rotation

Each key should belong to one workspace and environment with an explicit budget. The planned controls include revocation, rotation and separate test credentials. They are not implemented in the current landing page.

Access failures

The proposed error contract distinguishes invalid credentials (401), a source not enabled for the workspace (403) and a concurrency/rate limit (429). Clients should inspect the error code rather than repeatedly retrying a denied request.