API authentication
| Surface | Credential | Notes |
|---|---|---|
| Customer dashboard HTTP | Better Auth session cookie | Browser/session only |
| Hostinty MCP | Authorization: Bearer <HOSTINTY_PAT> |
Read-only PAT from Settings → MCP |
| Public probes | None | /public/health, /public/version, /public/status |
Create and revoke PATs only in the dashboard. Never embed PATs in Skills, screenshots, or chat logs.