Authorization: Bearer <token>, with your app’s publishable key in x-api-key. We check the token against your login’s settings, agreed when you’re set up, and count the fan once per widget. Reads don’t need it.
Widgets that need a signed-in fan have requires_sign_in: true. Show a fan who isn’t signed in your sign-in prompt instead of the options.
When a session fails
On a401, refresh the fan’s token from your login and retry the call once. If it fails again, ask the fan to sign in again. Never retry a 403.
Consent
How you pass a fan’s consent to us is being agreed. It will be described here.