API authentication and errors

Send the organization license key in x-license-key from a trusted server. Keep one key per integration where practical so access can be disabled independently.

Rotation

1. Create a replacement key in Studio.
2. Add it to the application secret store.
3. Deploy and verify the application uses it.
4. Disable the old key and monitor.
5. Revoke the old key after the rollback window.

Error handling

• Do not retry 400, 401, 403, 404, or 409 unchanged.
• Retry 429, 500, 502, 503, and 504 only with a bounded policy and jitter.
• After a timeout or ambiguous response, query the known trace before creating another generation.
• Preserve the server’s structured error code in internal logs, but show a safe message to end users.

Never fall back to a different template, input key, output key, or organization to hide a validation error. Configuration errors must fail clearly.