Authentication
Requests to the platform carry a bearer token in an Authorization header.
The header
Code
Send it on every request. The authenticated samples in Getting started read $AURA_TOKEN rather than embedding a token. The framework-generated samples on operation pages omit the header, and Try it likewise requires you to add it manually. No artifact this portal generates contains a credential.
Where the token comes from
Token issuance is deployment-specific. Contact the platform team that owns the gateway for the deployment you are integrating against.
Generated clients do not add the header for you
The 43 published OpenAPI documents declare no components.securitySchemes and no security block.
So an SDK or client generated from them will not attach Authorization on its own —
set the header explicitly in whatever you generate.
If a call is refused
A credential rejected at the gateway is refused before any service runs, so it raises no platform error code and nothing on an operation page describes it. The status and body the call returns are the account of the refusal; take those to the platform team that owns your gateway.
Failures that DO reach a service are documented on the operation pages: each declares the platform error envelope and the statuses a mapped failure arrives on, and most list the specific codes their handler raises.