Auth

Sign in on the site. Your app uses a key. Those are not the same thing.

Every Index and Cabinet call takes:

Authorization: Bearer pw_live_…

Sandbox keys are pw_test_. We store a hash. The secret is shown once.

What a key can do

• index:read — catalog lookups
• cabinet:write / cabinet:read — completed forms

Keys belong to a tenant. Cabinet data never crosses tenants. Notices are signed with a secret shown once (whsec_…).

Google and email links are how you reach the dashboard. Your servers use the keys the dashboard mints.