Authentication

Each endpoint page shows its effective security requirements. Operation-level requirements override the API-wide requirements.

BearerAuth

• Type: http bearer
• Description: API key token (envoy_<hex>). Create keys from Settings → API Keys — see Using the API.
• HTTP scheme: bearer

ExecutorKeyAuth

• Type: http bearer
• Description: Shared executor secret (ENVOY_EXECUTOR_KEY). Used by internal executor-to-control-plane routes (registration, heartbeat, completion/log callbacks).
• HTTP scheme: bearer
• Usage: Internal executor-to-control-plane requests only. Preserve this scheme on executor endpoints.

API-wide requirement

• BearerAuth (http bearer) API key token (envoy_<hex>). Create keys from Settings → API Keys — see Using the API.

An endpoint with an explicit empty security array is unauthenticated, even when the API defines an API-wide requirement.