Authentication
The API uses the BearerAuth security scheme (HTTP Bearer, JWT).
Bearer JWT Header
Get a token from /auth/login or /auth/employee/login, then send:
Authorization: Bearer YOUR_API_TOKEN
Subuser Customer Targeting
When authenticated as a subuser, include a target customer header for customer-scoped endpoints:
X-Customer-Number: 123456
17 March 2026