API credentials and the public API are planned and are not currently issued.
Authentication
The planned HTTP API uses bearer credentials over HTTPS.
Keep credentials in a server-side secret manager. Do not embed them in browser bundles, mobile applications, prompts, model context, logs, URLs, or source control. Authentication does not grant access to every Account object and does not constitute Approval.
Idempotency
Every mutation will require or use an Idempotency-Key.
Choose a stable key for one semantic intent. A retry of the same intent uses the same key; a changed intent uses a new key. Reusing a key with a different body should be treated as an error.
Idempotency prevents duplicate command processing. It does not make an ambiguous external effect safe to repeat. If Actual reports that an action outcome is unknown, wait for reconciliation rather than submitting a replacement action.
Safe retry outline
- Retry reads only for transient failures and with bounded backoff.
- Retry a mutation only with its original idempotency key.
- Honor
Retry-After on rate limits.
- Refresh state on revision or Approval conflicts.
- Never blind-retry an ambiguous external action.
