Skip to main content
All authenticated routes require:

​
Key format

Keys are tied to your organization. The key hash is stored server-side; the full secret is shown only when created or regenerated in Developer.

​
Obtaining a key

To generate a programmatic API key:
API Activation Required
API access is disabled for organizations by default. You must contact Michel ([email protected]) to enable API access for your organization before proceeding.
  1. Once API access is enabled by Michel, sign in to Your Product Here.
  2. Open Developer in your sidebar.
  3. Click Regenerate API key.
  4. Copy the key prefix and token immediately — it will not be shown again.
You can view the active key prefix anytime in Developer; use it to identify which key is in use without exposing the secret.

​
Security practices

  • Store keys in a secrets manager (never in client-side code or public repos).
  • Use your keys securely against the production API base URL.
  • Rotate keys from Developer if a key may have leaked; old keys stop working immediately.

​
Unauthorized responses

HTTP 401 — invalid or missing Bearer token.
HTTP 403 — org exists but API access was not enabled by admin.

​
Public routes

Only GET /health is unauthenticated.