API keys

An API key is the credential for the public API. You send it as a bearer token:

Authorization: Bearer sk_live_<public_id>.<secret>

The token format

A key token has two parts after the sk_live_ prefix, joined by a dot:

public_id — the non-secret display handle. It identifies the key (it appears in the dashboard and is used to look the key up at verification time), and it is safe to log.
secret — the secret half. It is hashed at rest and shown to you only once, when the key is created (and again only when you rotate it). See Key lifecycle.

Store the secret immediately

The full token is revealed exactly once. The platform stores only a hash of the secret, so it can never show it to you again — if you lose it, rotate the key.

Keys are tenant-scoped, not company-scoped

A key authenticates at the tenant level — it carries no company by itself. Company-scoped endpoints resolve the effective company from the X-Company-Id header, the key's optional default_company_id, or your tenant's default. See Company scoping.

What a key can do

A key's scopes are catalog permission keys chosen at creation. Each operation declares the permission it requires; see Scopes & permissions. Optional controls — an IP allowlist, an expiry, and a per-minute rate limit — are covered in IP allowlist, Key lifecycle, and Rate limits.

A bad or missing key

A missing, malformed, unknown, disabled, revoked, or expired key authenticates as nobody and returns a 401 with the unauthenticated envelope:

{
  "error": {
    "code": "unauthenticated",
    "message": "invalid api key",
    "requestId": "0190abcd-1234-7000-8000-000000000000"
  }
}

The error is deliberately uniform — it never tells you which check failed.