Authentication

Session (browser)

The evaldesk_session cookie is set on login/signup. Sent automatically by browsers.

API key (programmatic)

Authorization: Bearer evaldesk_live_...

Create keys in the API Keys page. Only the SHA-256 hash is stored. Keys support scoped capabilities.

Org header

x-org-id: org_abc123

Required on all /api/v1/* calls. Get from GET /api/v1/me.