Authentication

Authorization: Bearer <PARTNER_TOKEN>

Every Partner Demand endpoint requires this scoped token.

Credentials in query strings are rejected. The API does not enable cross-origin browser access. Keep the token in a secure local environment variable and never place it in a URL, source file, support message or shared command history.

curl --fail-with-body \
  --header "Authorization: Bearer ${BIZHEDGE_PARTNER_TOKEN}" \
  --header 'Accept: application/json' \
  'https://bizhedge.app/api/partner/v1/health'

Client rules

• Send the token on every request. Cursors do not carry authorization.
• Do not persist it in logs, analytics, browser local storage or error reports.
• Treat 401 as an access failure. Clear cached authorization and obtain the current token through the agreed secure channel.
• Do not use a browser-side proxy to bypass the cross-origin boundary.

The Partner Demand workspace stores its token only for the current browser-tab session and sends it in the Authorization header. Closing access clears that session value.