Credentials
What a credential is
A bearer token, issued against one short code. Send it on every request:
Authorization: Bearer <your-token>
A credential and access to a service are two separate things. The token identifies you and binds you to a short code; a grant gives that credential access to a particular service. Both must line up.
This is why a token that works for one service can be refused for another: that refusal is
ABILITY_NOT_GRANTED or SERVICE_NOT_FOUND, and it is a grant problem rather than a token problem.
Asking for a new token will not fix it.
Server-side only, always
A credential in a browser is a published credential. Every call in this documentation is server-to-server, including the anti-fraud script call, which looks like a front-end concern because its output is a script. Your backend fetches it and passes it to your page.
Store the token as you would any secret: in your environment or secret manager, never in your repository, never in client-side code, never in a URL.
If a credential is compromised
Tell the operator team immediately and it will be revoked. A revoked token fails with
CREDENTIAL_REVOKED rather than UNAUTHENTICATED, so you can tell "this was withdrawn" apart
from "this was never right", which matters when you are debugging under pressure.
What is checked, and in what order
Authentication is one of several checks, and they run in a fixed order. The first failure is what you are told about: see Order of checks.