x-api-key, which says which app is calling and sets its usage plan. It identifies the app; it never grants access on its own.
When a token fails, the API answers
401 with a WWW-Authenticate header. Get a fresh token and retry once. If it fails again, sign the user in again.
Every response carries x-request-id. Quote it when you report an issue.
Limits. Over your usage plan, the API answers 429 with Retry-After. Wait that long, then retry. See Errors and retries.