Integration authentication

The Commercial API authentication guide covers the server-side Authorization: Bearer <GOFA_API_KEY> credential used by the Commercial API. This section covers the separate client-integration routes under /api/client and /api/auth.

Use one credential type per request:

Backend integrations that already have a client secret can exchange it for a ClientToken.
User-facing integrations can use the Firebase user-authentication flow.
Authorized integrations can read and update records through the client-user endpoints.

Complete account registration on the GOFA website before using user authentication. Confirm client provisioning, module entitlement, and environment details with GOFA before building an integration.

Use one credential type per request:

Backend integrations that already have a client secret can exchange it for a ClientToken.
User-facing integrations can use the Firebase user-authentication flow.
Authorized integrations can read and update records through the client-user endpoints.

Complete account registration on the GOFA website before using user authentication. Confirm client provisioning, module entitlement, and environment details with GOFA before building an integration.