Apps authenticate as the installation, not as an end-user password. Admins grant scopes at install time; runtimes use install tokens.

Token types

Token	Owner	Use
Developer credentials	Publisher	Manage apps via Platform / Apps API
Install token	One org install	Call Tradeics APIs under granted scopes
Webhook signing secret	One app or install	Verify event authenticity

Install handshake (structure)

1. Admin starts install from Store or private link.
2. Consent screen shows scopes + pricing.
3. Platform redirects / POSTs to your setup URL with an authorization payload.
4. Your runtime stores the install id; retrieves install token via Apps API.
5. Token rotation: Platform can revoke; your app must refresh per docs at GA.

Authorization header

Authorization: Bearer <INSTALL_TOKEN>

Same family as Getting Started → Authentication, different audience (installation).

Next

• SecurityThreat model.Read
• Platform APIToken endpoints.Read
• QuickstartFirst install.Read