Authentication and sessions

• Control Plane users authenticate through the platform's managed authentication, including federated sign-in where enabled.
• Time-based one-time-password multi-factor authentication is supported natively for accounts, and is used to gate sensitive production actions.
• Machines authenticate with Partner API bearer keys, scoped per client, environment and program.

• Keys are environment-namespaced and carry no embedded metadata: sk_sandbox for sandbox and sk_live for production.
• A key value is shown once at issuance and is afterwards stored only in a non-recoverable form.
• Every request re-checks the credential status, expiry, client status, environment agreement, laboratory consistency and scope, so a revoked or rotated credential stops working immediately rather than at the next cache refresh.
• Issuing a production key requires an active client, an active grant to an active production program in the same laboratory and environment, and a verified multi-factor challenge.

Sandbox-issued keys are never granted the webhooks:manage scope; webhook subscriptions are managed by a laboratory administrator in the Control Plane.