Authentication

Every authenticated request sends both credentials. The secret never belongs in a browser.

GET /v1/organizations/me HTTP/1.1
Host: org.zyneo.app
X-Zyneo-Key: zyneo_key_test_a1b2c3d4e5f6
Authorization: Bearer zyneo_sk_test_z9y8x7w6v5u4

Header	Value
`X-Zyneo-Key`	`zyneo_key_test_…` or `zyneo_key_live_…`
`Authorization`	`Bearer zyneo_sk_test_…` or `Bearer zyneo_sk_live_…`

Errors

Auth failures return 401:

{ "error": { "code": "invalid_secret", "message": "API key and secret do not match." } }

Code	Cause
`missing_credentials`	A required header is absent.
`invalid_api_key`	Malformed, unknown, or revoked key.
`invalid_secret`	Malformed secret or hash mismatch.