Authentication
Every endpoint except /v1/health requires an API token in the Authorization header.
Authorization: Bearer fen_live_xxxxxxxxxxxxTenant scope
A token belongs to one tenant. Products, categories, and brands created with that token are automatically attached to that tenant. A token cannot read or modify another tenant's catalogue.
Token lifecycle
| State | Behavior |
|---|---|
| Missing | 401 missing_authentication |
| Malformed or unknown | 401 invalid_token |
| Revoked | 401 revoked_token |
Store tokens like passwords. If a token is lost or exposed, revoke it in the Fenestro backoffice and generate a replacement.