# Authorization

Call `ExchangeApiKey` with the Partner API key to receive an auth token. The token expires after
1 hour; call `ExchangeApiKey` again when it does. Every other endpoint takes that token as
`Authorization: Bearer <auth_token>`.

Endpoints scoped to a company or an employee also take identity headers, which is how the platform
resolves the Partner's association to that entity:

| Header | Value |
|  --- | --- |
| `Authorization` | `Bearer <partner_jwt>` |
| `X-Identity-Uuid` | `<company_uuid>` |
| `X-Identity-Type` | `COMPANY` |


Employee-scoped calls send the employee UUID with `X-Identity-Type: EMPLOYEE`; the shared service
accepts either identity type. Each service page in the
[API reference (gRPC)](/grpc/partnerauthingressservice) states the headers it expects.

## Plan configuration

By default, plan configuration endpoints require the auth header with target company UUID:

```http
Authorization: Bearer <token>
x-identity-uuid: <company_uuid>
x-identity-type: COMPANY
```

Endpoints that do not require a company-specific header are indicated below.

The employee's direct login (via `SharedAuthIngressService.Login`) continues to work unchanged.