Authentication

Server-only rule

• Use the key from backend code only.
• Return product-shaped responses to the browser.
• Proxy file previews and downloads through authenticated product routes.
• Do not forward caller-controlled org, member, Workspace, or harness IDs without server-side validation.

Open standard
This page's server-only Bearer rule is the client-side counterpart of UHP's credential requirements, which forbid a credential from ever appearing in a response body, event, log line, or artifact. See credential rules in UHP's Security chapter.

Create API Key →

Ready to run this against a live workspace? Keys take under a minute.