Bearer-token auth with scoped, workspace-bound API keys. Create per-integration keys (never share one key across systems), rotate on a schedule, and use read-only scopes wherever writes aren't needed.
Key management
Settings → API → Keys: create, scope, label, and revoke. Label keys by consumer ("warehouse-sync", "zapier-prod") so revocation is surgical when something leaks or retires.
Scopes
Per-key: read vs read-write, and object scopes (contacts, accounts, sequences, signals, admin). Principle of least privilege — the analytics pipeline doesn't need sequence-write.
Rotation
Keys support overlapping rotation: create the new key, migrate consumers, revoke the old. Set a calendar rhythm (quarterly for write keys) — the key list shows last-used timestamps to catch zombie keys.
Security notes
Keys transmit only over HTTPS, are stored hashed, and every call is attributed to its key in the audit log. A leaked key's blast radius is its scope — which is why scoping matters.
