Authentication

Most endpoints require a JWT Bearer token obtained via /auth/login/manager. Merchant integrations may also use API Key + Secret headers.