Administrator integrations
An administrator API key inherits the permissions of its linked administrator. Use a deliberate integration account and keep the key in the server environment.
Customer-facing identity
Use the supported OAuth2 sign-in approach for a customer application. Authentication identifies the person; it does not replace the customer membership and authorization checks.
Authorization is a separate step
Resolve the permissions required for a read or action. A signed-in person should only operate within the customer contexts and capabilities they are allowed to use.
Design for denied access
Make a permission failure understandable in the interface. Avoid retrying a denied operation as if it were a transient network failure.