Skip to main content

Authentication

Every request to the API is authenticated with an API key, sent as a header:

X-API-Key: YOUR_API_KEY

There is no OAuth flow, bearer-token exchange, or request signing — the key is the credential.

Getting a key​

API keys are issued per organization from the dashboard's API Keys page by an Admin or Member. The full secret is only ever shown once, at creation time; the dashboard afterwards shows only the last four characters, so treat it like a password and store it in a secrets manager, not in source control.

Key properties​

  • Scoped to an organization, not an individual user. Any request authenticated with a key acts on behalf of that org — usage, rate limits, and quota are all tracked per org.
  • Revocable independently. Revoking one key has no effect on any other key belonging to the same org.
  • Can carry its own system prompt override, layered on top of (and taking priority over) the org's default — see System Prompts.

Errors​

An invalid, revoked, or missing key returns:

HTTP/1.1 401 Unauthorized
{"detail": "Invalid or missing API key"}

See Errors for the full list of status codes the API can return.

Rotating a key​

There's no in-place "regenerate secret" — create a new key, switch your integration over to it, then revoke the old one. Because keys are independently revocable, this is zero-downtime as long as both keys are live during the cutover.