Authentication

An organization Admin mints keys in the app under Settings → API keys ("Create API key"). The key is shown exactly once at creation — copy it immediately; the server stores only a hash and it can never be retrieved again. If you lose it, revoke it and mint a new one. (No Admin access? Ask your account contact.)

Send the key in the Authorization header. All three forms are accepted:

Authorization: <key>
Authorization: Bearer <key>
Authorization: Api-Key <key>

A missing, malformed, revoked, or expired key gets a 401 — with one deliberately uniform message, so the API never reveals which of those it was.

Scopes

A key minted with no scopes has full access. Scoped keys carry any of calls:write (send), calls:read (list/detail/recording), and pathways:read (list pathways); a request outside the key's scopes gets 403. Use scoped keys for integrations that only need to read.

Checking who you are

GET /me returns the organization and scopes behind the key you're holding — handy for verifying a freshly minted key before wiring it into an integration. See the Identity reference.