Authentication and access
How the application’s session boundary differs from credentials for an external integration.
Application sessions
The web app uses its normal sign-in flow and server-managed session cookies. Application JavaScript does not need to retrieve a session token to call its own API.
The presence of a cookie is not sufficient authorization. Protected operations validate the session and the requested resource on the server.
Browser mutations
Cookie-authenticated mutations are restricted to the trusted application origin and checked for a request marker. Public documentation on a separate origin does not receive permission to make those mutations.
A browser origin check is not a substitute for authenticating the user. Both checks apply to protected actions.
External integrations
Do not export a browser cookie or embed a privileged server credential in an integration. This documentation does not publish an external authentication mechanism.
Use supported connection flows for available services. Before a public API launch, its authentication and scope model need their own reviewed contract.