The REST API, API clients, and webhooks — Create an API client (2)

That returns an accessToken (a signed JWT) with expiresIn seconds — about an hour. Send it as Authorization: Bearer (an X-Api-Key header works too) on every other call, and exchange again when it expires. A client acts on its one workspace with admin-grade access, so treat the secret like a password — keep it server-side and never ship it in client code. Revoke a client from the Developers page at any time; it then mints no new tokens, and any it already issued stop working within the hour.