Authentication

The current merchant desk uses its existing workspace session through the web application. Browser calls are same-origin requests proxied to the Nest API; do not copy session cookies into scripts.

B2B API status

The public partner API key gate is planned, not available in this release. When it is implemented, keys will be organization-scoped, stored only as enc:v1: envelopes, and protected by the api-key-throttle-cache Redis gate.

Never place courier credentials, cookies, or vault values in a support ticket or code sample.