/languages

The secret half. A vendor token starts vnd_ — the four-character prefix says which table to resolve it in, so the row it matches is the caller. A clt_… token on this prefix is a 403, not a 404.

The identity half — this vendor's own 40-hex apiToken, issued alongside the bearer token and handed over with it. Compared in constant time against the bearer token's own row by DeveloperApiAuthFilter, before any handler runs, so a bearer token lifted on its own is not enough to call anything here. There is no endpoint that will tell you this value — an integrator who has lost it asks for the pair to be regenerated.

Response media type.