All requests hit the Mooly domain. The edge transparently routes to the backend — you never need the backend address.

Send the API key via the X-API-Key header on every request. Never pass it in the query string — it would leak into access logs.

The API key must have the products permission. Create one in Settings → API keys and copy it right away (shown only once).

Watch the X-RateLimit-Remaining and X-RateLimit-Reset headers. Exceeding the limit returns HTTP 429.