Sandbox available · Production unavailable

Use the credential for its own boundary

A browser session, Platform OAuth grant and Ledgero service credential are deliberately not interchangeable.

Tenant backend calls

Send the Environment's service credential as an HTTP Bearer value from a trusted backend. The credential supplies tenant identity; do not add a caller-selected tenant header or query parameter.

curl --fail-with-body \
  --header "Authorization: Bearer $HEADLESS_SERVICE_CREDENTIAL" \
  --header "Accept: application/json" \
  "$LEDGERO_CONTROL_URL/v1/administrative/lots?limit=25"

Browser and future public clients

The Web console uses an opaque, secure, host-only BFF cookie.
OAuth grants name one Workspace, one Environment, one resource and closed scopes.
The public CLI will use authorization code + S256 and OS-protected refresh storage; it is not published yet.
The hosted MCP resource will reject API-audience tokens and direct mutation; it is not published yet.