Skip to main content

Authentication

A project API key looks like proj.<keyId>.<secret>. The middle segment identifies the key; the last is the secret, which is hashed on our side and never recoverable after creation.

The header

Authorization: proj.KEY_ID.SECRET
No Bearer prefix

The token is sent raw. Authorization: Bearer proj.... will fail with a 401 — a common first-try mistake if you are used to OAuth-style APIs.

Keys are managed in Project Settings → API keys, where you can:

  • Create a key with a specific set of permissions.
  • Edit an existing key's permissions without reissuing the secret.
  • Disable a key temporarily — a disabled key fails authentication but keeps its configuration.
  • Delete a key permanently.

Workflow code nodes are a special case: they receive a short-lived execution token automatically and use it to reach the library of the project they are running in. You never create or manage those.