The API uses the BearerAuth security scheme (HTTP Bearer, JWT).

Get a token from /auth/login or /auth/employee/login, then send:

Authorization: Bearer YOUR_API_TOKEN

When authenticated as a subuser, include a target customer header for customer-scoped endpoints:

X-Customer-Number: 123456