Authentication

Authentication in Meridias separates dashboard access, service credentials, and environment-specific API usage. Teams should provision credentials for the exact workflow they intend to automate.

Access model

Dashboard authentication is used for human operators managing organisations, policies, and benchmark visibility. API credentials are issued separately so automated workloads can be rotated without affecting user access.

Request credentials

API requests are authenticated with scoped keys issued to an environment. Production and non-production credentials should be isolated so routing experiments and internal testing cannot affect live traffic.

Signing and transport

Requests should be sent over TLS and include the required authentication header on every call. Credentials must be stored in a secret manager and injected at runtime rather than committed into repositories.

Rotation guidance

Rotate keys on a scheduled cadence and immediately after any suspected exposure. When rotating, deploy the replacement key first, verify traffic continuity, and then revoke the previous credential.

Next step

Continue to First Request once your credentials are provisioned.