Authentication

GET /v1/status is public. All incident mutations require a bearer token:

Authorization: Bearer pf_live_example

Keep the token in a server-side secret store. Never embed it in a status page, browser bundle, or custom element.

An absent or invalid token returns 401 with {"error":"unauthorized"}.