Authentication & Scopes
Bearer token
Every request carries a standard bearer header:
Authorization: Bearer brz_live_...
Never a custom header, never a query parameter — this keeps a key out of URLs, browser history, and proxy access logs by construction.
Scopes
A key is scoped at creation to exactly the permissions it needs:
| Scope | Grants |
|---|---|
account:read |
Read your own account profile |
wallet:read |
Read your own wallet balance |
catalog:read |
Browse the live catalogue |
orders:read |
Read your own order status/delivery |
orders:write |
Create orders |
webhooks:manage |
Register/list/revoke webhook endpoints |
Scopes are fixed at creation — there is no in-place edit. To change a key's scopes, revoke it and create a new one with the scopes you need.
Errors
| Status | Meaning |
|---|---|
401 |
Missing, invalid, or revoked key — always the same generic message, so a credential-stuffing attempt can't use the response to narrow down whether a key prefix exists |
403 |
The key is valid but lacks the scope this endpoint requires |
See Errors & Rate Limits for the full error envelope.
Key management
Keys are managed exclusively through your Brenoz account's Account → Developer page — never
through the Reseller API itself (there is no POST /keys endpoint on this API; that would be a
chicken-and-egg problem, since you'd need a key to create a key).