Authentication
Every /v1/* request to api.blocktrellis.com carries a bearer token. /health is the only unauthenticated route, and it returns nothing but a status.
Header
http
Authorization: Bearer bt_live_…
Keys are issued per project. A key can read every live endpoint; there is no per-endpoint ACL in beta.
Errors
A missing, malformed, or unrecognized token returns 401 with a JSON body — never an HTML page. There is no separate revoked/403 state yet: a key either works or it doesn't.
BetaKey issuance is currently manual. Request one through the GitHub repository while self-serve is being built.