X-Organization-Id with a service key. Supplying another organization’s ID does not change the key’s authority and is rejected. Organization and project identifiers in a request are selectors, never proof of permission.
The issuing human cannot grant permissions beyond their current grants. Once issued, keys are independent service credentials: removing their creator from the organization does not revoke them. Revoke or rotate the key explicitly. Suspension of the organization, project archival or environment deactivation prevents authentication. Workers recheck service-key and resource authority before dispatch.
Secrets are shown once at creation and rotation. Rotation immediately invalidates the previous secret. Use separate keys for distinct services and environments and supply an expiry where appropriate. There are no AI service-key scopes.
Human setup versus service calls
Organization onboarding, project creation, key issuance/rotation/revocation, wallet funding, Meta connection and rental requests are management operations. They use authenticated customer sessions, CSRF protection, RBAC and recent MFA where required, rather than a service key. Superadmin operations use separate staff roles. These management endpoints are deliberately excluded from this developer reference. Operators can use the complete internal OpenAPI anddocs/BACKEND_HANDOFF.md during provisioning. Do not automate customer setup with copied staff cookies or distribute management cookies to application servers.