Every /external/* endpoint requires a bearer token:

Authorization: Bearer {your-api-token}

What the token is

The Adapter Gateway uses static API tokens. A token:

is an opaque string — treat the whole value as a secret;
is bound to a single adapter (adapterId), which in turn is bound to the channel(s) your adapter is allowed to serve;
is shown only once, when it is created. It cannot be retrieved again afterwards, so store it securely (a secrets manager, not source control).

Calls made with the token are authorized per channel: requests that reference a channel your adapter is not bound to are rejected with 401.

How to obtain a token

Adapter Gateway tokens are issued by Stibo Systems: contact your PDX representative and request an adapter token for the environment you are targeting. As part of onboarding you will be asked for the PDX client and user that should own the adapter and its channels. You will receive:

adapterId — the identity of your adapter;
the API token — used in the Authorization header;
channelId — the channel your adapter is bound to (agreed as part of onboarding).

Tokens are issued per environment: a preprod token does not work in production. If you develop against multiple environments, request a token for each.

Rotating and revoking tokens

To rotate a token, request a new one from your PDX representative and switch your adapter over; the old token can then be revoked. If you suspect a token has been exposed, contact your PDX representative immediately so it can be revoked.

Troubleshooting

Symptom	Likely cause
`401` on every call	Token missing, malformed (check for a lost `Bearer` prefix or whitespace), or revoked
`401` on calls for a specific channel	Your `adapterId` is not bound to that channel — verify the `channelId` with your PDX contact
Token works in one environment but not another	Tokens are environment-specific — request one per environment