Authentication
User login
POST /v1/auth/login
Returns access and refresh tokens (JWT, RS256). Use the access token until expiry, then refresh.
Authorized requests
Authorization: Bearer <access_token>
Catalog and integration APIs also require tenant context (from token claims or X-Tenant-Id where applicable).
Service accounts
Tenants may use service accounts with API keys or client credentials for automation — created in admin/backoffice. Treat secrets like production passwords.
Scopes & permissions
Operations enforce RBAC permissions (e.g. pim_mgmt:products:view). A 403 indicates missing permission, not invalid credentials.