// Server-to-server call to a CodeB tenant using an API key.
// European Digital Identity Wallet claims are out-of-band; API keys are
// for background jobs.
// [m2m-cookbook 2026-07-23]
//
// Mint the key at https://<CODEB_TENANT_HOST>/api-keys-admin.html
// Keys have the form ak_XXXXXXXXXXXXXXXX and MUST travel over TLS.

using System.Net.Http.Headers;

const string Tenant = "https://<CODEB_TENANT_HOST>";
string apiKey = Environment.GetEnvironmentVariable("CODEB_API_KEY")
    ?? throw new InvalidOperationException("set CODEB_API_KEY=ak_...");

using var http = new HttpClient { BaseAddress = new Uri(Tenant),
                                  Timeout = TimeSpan.FromSeconds(15) };
http.DefaultRequestHeaders.Authorization =
    new AuthenticationHeaderValue("Bearer", apiKey);

var body = await http.GetStringAsync("/api.ashx?action=users.list");
Console.WriteLine(body);