Authentication
There is no API key. An agent gets in the same way a merchant does — a one-time code to their email — and operates with exactly their permissions.
Why OTP and not a token
An API key is a long-lived secret that ends up in a config file, a shell history and a backup. The OTP flow produces a session bound to a real person who can end it, and it means the answer to “can this agent reach my store?” is the same as “can this person sign in?”
What the session can reach
Only the signed-in merchant’s own store. Every read is scoped to it explicitly — the server does not rely on row-level security alone to keep tenants apart, because a single missing filter would be a cross-tenant leak.
Sessions expire and refresh
The stored session refreshes itself as it nears expiry and re-persists. If refresh fails, tools return Not logged in and you sign in again — they do not silently fall back to anything weaker.
No service credentials, ever. The server holds no service-role key. That is enforced by test: the suite fails if one appears in the source at all.