Quickstart
Two requests: one for a token, one that uses it. Everything else in the API follows the same shape.
1. Get a token
A service authenticates with the client-credentials grant. Name the scopes the token should carry; each must already be granted to the client.
The answer is a bearer token (an EdDSA-signed JWT) and the number of seconds it lasts. Ask for a new one before it expires rather than on every request.
2. Call the API
Send the token as Authorization: Bearer. Lists answer with a data array and has_more; see Pagination.
3. Write something
Every write takes an Idempotency-Key, so a retry after a timeout can never act twice. See Idempotency, then pick a resource from the API reference.