Authentication
API keys, sessions, customer tokens, and how authorization is enforced.
There are three ways a request authenticates, each resolving to a principal the API authorizes against.
1. Organization API key (crmk_)
Server-to-server + MCP. Sent as Authorization: Bearer crmk_…. Resolves to the
key's organization and its scopes. See API keys & scopes.
2. User session
The admin app logs a user in and carries a session cookie. The user's role determines what they can do. Use this for browser contexts (including the Explorer, which sends your session automatically).
3. Customer token
Storefront shoppers authenticate as customers (account login, order history, wishlist). Customer tokens are strictly separated from user/admin principals — a customer token can only act as that customer.
Authorization
Every resolver checks the caller's organization boundary and permission before reading or writing. Cross-organization access is denied at the data layer (row-level security), so even a bug can't leak another tenant's rows.
Note
If you get UNAUTHENTICATED, the credential was missing/invalid. FORBIDDEN
means you're authenticated but lack the scope/permission or are crossing an org
boundary.