Skip to main content

​
Bearer API keys

Pass your secret key on every request:
Keys are shown once at creation, stored hashed at rest, and always carry an expiry (maximum 90 days).

​
What the key carries

Resolving a key binds the request to:
  • Tenant (workspace)
  • Environment (live or sandbox from the key prefix)
  • Optional IP allowlist
  • Revocation and kill-switch state (global or per tenant)

​
Idempotency

Mutating requests (POST, PATCH, DELETE) should send:
Keys are scoped to (tenant, environment, api_key).

​
Next