Authentication and scopes

Only Authorization: Bearer keys work on v1. Session cookies and query-string tokens do not authenticate. Keys cover the owner's accounts and selected capabilities; there is no per-X-account restriction in v1. Read and write scopes are independent. Keys expire after 90 days by default (1–365 days configurable); at most 10 active keys. Rotate by creating a replacement, updating your integration, then revoking the old key. Revocation affects new requests, not already accepted jobs.