Trusted backends

Go, Node, Python, .NET, PHP and other servers use the same HTTP API with a scoped service credential.

Read records

curl "$TRESTLE_URL/api/v1/collections/issues/records?limit=25" \
  -H "Authorization: Bearer $TRESTLE_SERVICE_TOKEN"

Create a record

const response = await fetch(`${process.env.TRESTLE_URL}/api/v1/collections/issues/records`, {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.TRESTLE_SERVICE_TOKEN}`,
    "Content-Type": "application/json",
    "Idempotency-Key": requestId
  },
  body: JSON.stringify({values: {title, owner_id: userId}})
});

Give each service and environment a separate credential. Propagate request IDs, handle structured errors, use idempotency keys for retryable creates, and never forward the service secret to a browser.