Authentication

Every Tenant API request must include a valid site API key. Keys are bound to one site — using site A's key against site B's path returns 401.

API keys

Keys are generated on the API page in your workspace (`fig_live_` + 48 hex chars). The full secret is shown once at creation. We store only a SHA-256 hash server-side.

Scopes

Current keys grant read access to draft and published content, plus training export when opted in. Write operations use the app UI or the content system — not the public REST API.

Security practices

• Revoke compromised keys on the API page and create a new one
• Never embed keys in client-side JavaScript
• Use HTTPS only — keys sent in Authorization header

Site binding

The path parameter `siteId` must match the key's site. This prevents cross-tenant data access even if a key leaks from another customer.