API authentication guide
Use the generated endpoint and Bearer token safely for every external request.
Required header
Every inbound request must include the Authorization header with the API token generated for that connection.
Header format
- Authorization: Bearer YOUR_API_TOKEN
- Content-Type: application/json
- Optional: X-BOS-Idempotency-Key for duplicate protection.
Security best practice
Keep one token for one external system. If a token is exposed, regenerate it from the connection page and update the external app.