Authentication & Tenancy

Private APIs use QUMI JWT/session context plus role/permission guards. Tenant scope is derived or asserted server-side.

Public checkout explicitly rejects client-supplied trusted customer identity fields; an authenticated tenant customer session is resolved by the server.

Future partners should use scoped application credentials and tenant grants rather than impersonating first-party user sessions.