Authentication

The external REST API authenticates with admin-issued API keys sent in the X-API-Key header (not a Firebase token):

GET /api/v1/employees HTTP/1.1
X-API-Key: pg_live_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

Keys are pg_live_<32-byte base62>, stored only as a SHA-256 hash, bound to one organization and a set of scopes. The plaintext secret is shown exactly once at creation. On each request the key is hashed and looked up; revoked or expired keys are rejected (failing closed), the route’s required scope is enforced (default deny), and a per-token rate limit is applied.