Bearer token
Most product endpoints require:
Authorization: Bearer YOUR_TOKENCreate tokens in the app: Account → API.
Token types
| Prefix | Type | Use | Safe in a browser |
|---|---|---|---|
po_sk_ | System key | Server-to-server integration, full API access | No |
po_ut_ | User token | User scope — MCP Connect; rights follow the user and licence | No |
po_gt_ | Group token | Group scope — inherits rights and workspace whitelist of a user group | No |
po_pk_ | Publishable key | Browser / AI canvas — not for MCP; origin set by the key owner, budget-capped; product APIs allowed | Yes |
Publishable key — security model
A publishable key may sit in the browser. All documented product APIs are allowed. HTTP DELETE, account administration, key management, OAuth, payment mutation and password cracking stay blocked. Every request needs an Origin that the key owner entered — there is no shipped vendor host list. A lifetime budget caps consumption.
Create one in the app: Account → API → publishable key.
Visitor mode
Without a token only infrastructure endpoints stay reachable. Product APIs including geolocation and exchange rates need a Bearer token.
| Endpoint | Function |
|---|---|
/docs/* | Public specification |
/health | API health check |
/ping | Connectivity test |
Job and processing endpoints need a Bearer token. Visitor sessions have minimal credits and strict rate limits. Missing product-API auth is HTTP 403 TIER_RESTRICTED, not HTTP 401.