429/5xx retries, and a webhook signature verifier:
Base URL
/v1. Breaking changes will be released under a new version prefix; additive changes ship in place.
Authentication
Every request must carry a Bearer API token. The first call from any new integration should beGET /v1/me — it requires no scope and confirms the token is alive:
200 response returns the token’s identity card and the organization it belongs to. Create tokens in the dashboard at Settings → API Tokens. They look like sk_live_<random> and are shown only once at creation — store them securely. See Authentication for scopes and best practices.
Content type
Request bodies are JSON. SetContent-Type: application/json on every POST, PATCH and DELETE request that has a body.