Auth modes

How tenant credentials, Portal sessions, and Portal-issued API keys differ.

DLaaS itself accepts three header sets:

| Mode | Header(s) | Used for | | --- | --- | --- | | Tenant | X-Tenant-Api-Key + X-Tenant-Api-Secret | Per-tenant CRUD and runtime traffic | | Control plane | X-Control-Plane-Secret | Tenant bootstrap, admin views | | Service | X-Service-Secret | Snapshot export, runtime diagnostics |

The Portal collapses these for end users:

You sign in with email/password or OAuth.
The BFF resolves your active organization and decrypts its tenant secret.
Every /api/proxy/dlaas/* call is signed with the tenant headers automatically.
Admin-only endpoints use the Portal pod's DLAAS_SERVICE_SECRET.
Portal API keys (created in Settings) authenticate non-browser clients to the Portal BFF; the BFF still translates to DLaaS tenant headers.