The app's own server exchanges your API key for a 10‑minute bearer token and renews it automatically. The key is kept only in this browser tab (sessionStorage — cleared when the tab closes) and sent over HTTPS to the app's proxy; it is never stored server‑side, logged, or shared with other visitors.
POST {baseUrl}/auth/access-token with x-api-key → { access_token, expires_in, token_type }Authorization: Bearer …, x-gemba-application-id, x-gemba-user-id and a fresh x-gemba-request-id (idempotency key).