Authentication & authorization

Base URL

All Partner API requests use production:

https://studio.zentag.ai/api/v1/partner

Every request must include your secret key. Two header forms are accepted:

Authorization: Bearer zt_live_sk_...

x-api-key: zt_live_sk_...

Keys are:

Hashed at rest - only a SHA-256 hash is stored; the plaintext secret is
shown once at creation.
Scoped - each key carries a set of scopes. Requests without the required
scope return 403 insufficient_scope.

Scope	Grants
`clips:read`	List clips and read clip metadata, export JSON, and status
`clips:write`	Create, update, delete clips and trigger generate / autoflip / reframe / crop jobs
`highlights:read`	List highlights and read highlight metadata and progress
`highlights:write`	Create, update, delete highlights and trigger generation jobs
`media:read`	Read the media library (filters/stats) and request signed media URLs
`publish:read`	Read publish history and publish event status
`publish:write`	Publish clips to connected social destinations
`storage:write`	Push clips to configured external storage buckets (including bulk)
`webhooks:manage`	Create and manage webhook endpoints and view deliveries
`catalog:read`	Read competitions, teams, players, tags, and stream metadata
`catalog:write`	Create, update, and delete competitions, teams, players, and tags
`streams:read`	List and read streams (`catalog:read` also accepted for backward compatibility)
`streams:write`	Create, update, and end streams

Rotate a key to mint a replacement while the old key stays valid for a
short grace window (default 24h), then revoke it.
Revoke a key immediately to disable it.

For high-trust partners, an app can restrict requests to specific source IPs or
CIDR ranges. Requests from other IPs return 403 ip_not_allowed.

All requests must use HTTPS. Never embed secret keys in client-side code.