Authentication
Authenticate API and internal requests.
Orbitali uses separate authentication paths for different surfaces.
API keys
Use API keys for programmatic access to the public API.
Authorization: Bearer <api-key>API keys identify the account that owns the request.
Dashboard sessions
Dashboard users authenticate with session cookies issued by the UI and API.
Internal service secret
The Go agent uses a server-to-server secret when calling internal API endpoints.
x-orbitali-server-secret: <secret>Do not use the internal service secret in browser or customer-facing code.