Authenticate Graft calls

Gateway --projectKey authenticates publication, not each invocation. A call credential authorizes one specific call and is validated inside Receiver methods or through generated header APIs. See Project Key, registry, host, and credentials for how this differs from the Project Key, registry URL, and runtime host.

Option 1: token as a method parameter

Pass apiKey or bearerToken as a supported primitive parameter and validate before side effects. This works in every runtime and in browser clients.

Option 2: generated headers

using <generated_namespace>;

GraftConfig.Host = "wss://service.example/ws";
GraftConfig.Stateless = true;
GraftConfig.SetHeaders(new Dictionary<string, string> {
    ["Authorization"] = "Bearer <token>"
});

var result = PriceService.Calculate(100, 10);

Receiver-side validation

Default deny: reject missing or invalid tokens with a clear domain exception. Do not log secrets.

Next steps

• Authentication operations
• Configure invocation