Copy page

Guides

Authentication

All public API operations authenticate with an API key sent as a bearer token:

Code
Authorization: Bearer atk_...

Keys carry the atk_ prefix. There are no query-string or cookie alternatives for programmatic access.

What a key is

A key belongs to your organization and acts as it: actions run against the organization's data and are billed to it. Keys are named, revocable, and track last use; the secret is shown once at creation.

A key's lifecycle is tied to the member who created it — removing that member deletes every key they created. Re-key an integration under a surviving member before an offboarding.

What a key may do — and never do

• Keys cannot mint keys. Key creation and revocation are not on this surface at all; they happen in the dashboard, by a signed-in person.
• Billing, plans, and impersonation are not on this surface. Those operations exist only where a person is signed in; you will not find them in this reference, by construction.
• Administration is capped at the creator's role. A key may perform the administrative operations in this reference (for example managing members) only at or below the role of the member who created it — a key never escalates above its creator.
• Feature flags narrow further. At creation a key's flags can never exceed its creator's; afterwards the key is capped by the organization's entitlement. An operation refused on a flag answers 403 naming the missing flag.

Owners and admins can see and revoke every key in the organization; members see only the keys they created.

Failure modes

Response	Meaning
401 missing bearer token	No Authorization: Bearer ... header.
401 invalid or expired token	The key is unknown or revoked.
403	Authenticated, but this key may not perform the operation.

See Errors for the full picture.