Authentication and scopes

Bearer API keys

GET /v1/environments/{environmentId}/customers
Authorization: Bearer <environment-api-key>
Accept: application/json

The API validates the credential, resolves its environment and organization, then applies the operation’s required scope and tenant filters. The OpenAPI contract lists the required scope for each public operation.

Credential handling

• Store keys only in backend secret storage.

• Use distinct credentials and least-privilege scopes for each integration boundary.

• Rotate and revoke keys through the authenticated portal.

• Do not place API keys in Scalar’s public server configuration, public site runtime JSON, mobile apps, or browser bundles.

• Authentication failures and scope denials use typed Problem Details responses with correlation identifiers.

• Environment isolation

• Operation scopes in OpenAPI