> ## Documentation Index
> Fetch the complete documentation index at: https://docs.terabusinessfinance.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Bearer credentials, environment binding, and scopes for the Contracted Supplier API.

Authenticate every request with an `Authorization: Bearer` credential issued by Tera staff.

Canonical credential syntax uses an underscore separator only:

```text theme={null}
tcs_test_<public_id>_<secret>
tcs_live_<public_id>_<secret>
```

```http theme={null}
Authorization: Bearer tcs_test_cred_northbridge_REPLACE_WITH_YOUR_SANDBOX_SECRET
```

## Test versus live keys

| Prefix      | Form                            | Host                                         | Environment field |
| ----------- | ------------------------------- | -------------------------------------------- | ----------------- |
| `tcs_test_` | `tcs_test_<public_id>_<secret>` | `sandbox-api.terabusinessfinance.com` (live) | `sandbox`         |
| `tcs_live_` | `tcs_live_<public_id>_<secret>` | `api.terabusinessfinance.com` (not yet live) | `production`      |

Sandbox is available now. Production is not yet available: there is no READY production API deployment and production traffic is disabled.

Effective permission is **account ∩ credential ∩ environment**. A test key on the production host, or a live key on the sandbox host, is rejected.

Do not send an `environment` field on a production create body to redirect the data plane.

## Scopes

A credential may include one or more of:

* `supplier_submissions:create:basic`
* `supplier_submissions:create:application`
* `supplier_submissions:read`
* `supplier_submissions:correct`
* `supplier_submissions:promote`

Unauthorised level or missing scope returns **403** and creates **no** row. A basic-only credential cannot create an application-level submission.

## Secret handling

* The secret is shown **once** when staff issue or rotate the key.
* Store it in your secret manager. Tera cannot recover plaintext.
* Send only the `Authorization` header. Do not put the secret in query strings or bodies.
* After rotation, revoke the previous credential. See [Key rotation](/guides/key-rotation).

## Request IDs

You may send `X-Request-Id`. Tera always returns `X-Request-Id` on the response. That header is the canonical correlation identifier. Quote it with `submission_id` and `external_reference` when you contact support.