Messaging infrastructureHTTP API
API authentication
Authenticate service calls and keep internal worker credentials outside the public bearer-token boundary.
API authentication — contract and behavior
- Every public route checks Authorization: Bearer $SERVICE_API_TOKEN.
- The public service token authenticates callers but does not authenticate remote physical workers.
- Webhook signing secrets are per subscription and are never returned after the subscription creation response.
- Internal routes and remote-worker upgrades use dedicated worker identity and mTLS controls.