Authorization: Bearer YOUR_TOKEN and Accept: application/json. Tokens are created and revoked from GVB’s authenticated API Access page. Use a service account for unattended integrations and grant only the tenants and permissions it needs.
Tokens are secrets. Store them in a managed secret store, rotate them after suspected exposure, and never include them in query strings, browser storage, logs, generated documentation, or client-side applications.