API v2 uses JWT tokens for authentication. Users authenticate via magic link (email code) or social login, and receive a JWT token that must be included in all subsequent requests.