Authorization: Bearer <workspace-token>. Tokens are provisioned by an administrator in the pilot; OAuth and self-serve token issuance are not available.
Never put a token in a URL or a published document. Keep agent tokens in your client’s secret store or environment. Revoke them by removing their hash from Bindo’s private runtime configuration.
Configuration also has separate scopes for knowledge, assistant, enquiry, channel and reply-rule changes. Use explicit scopes; a wildcard agent token does not grant management permissions.