Security — The API

The public API authenticates with OAuth 2.0 client credentials: a client id and secret are exchanged for a bearer token that expires after an hour. Secrets are shown once at creation and stored hashed, so a leaked database does not yield usable credentials. Requests are rate-limited per credential, and anonymous requests are held to a much lower ceiling than authenticated ones. API access is subject to exactly the same permission resolution as the UI — a token cannot read a field its owner cannot read.