Authentication
Two credentials: a product API key for server-to-server, an OAuth token for acting as a person.
Two things authenticate against Guiru, and they are not interchangeable.
gk_live_…/gk_test_…product API key- Server to server. Scoped to one product — the key *is* the product, which is why no endpoint takes a product id. Never ship it in a client.
gat_…OAuth access token- Acts for one person who consented. Obtained through Sign in with Shin ID. Valid 30 days, revocable by that person at any time.
Both travel the same way — and the SDK takes whichever one an endpoint needs, so the wrong credential in the wrong place fails before it becomes a request:
Authorization: Bearer gk_live_…Storage
Keys and tokens are stored hashed on our side; a key is displayed exactly once, at creation. There is no endpoint that reads a credential back, for you or for us. Lost key means new key.
Revocation
Revoke a key in the product console; it stops working on the next request. A person revokes your access under Settings → Apps, which kills every gat_ token for that client — treat a sudden 401 as consent withdrawn, not as an outage, and send them back through sign-in.