Authentication
Every call carries an Authorization header with your API key.
Every call carries an Authorization header with your key.
Authorization: Bearer ptr_live_a1b2c3d4_1a2b3c4d5e6f7g8h9i0j1a2b3c4d5e6fGetting a key
In the app, under Settings → API & MCP. Only the workspace owner or an admin can create one.
The secret is shown once, at the moment you create it. After that we keep only a hash, and no screen or support person can recover a lost key. If you lose it, revoke the old one and create another.
What a key can reach
A key belongs to one workspace and sees everything that workspace has, with the same permissions as the person who created it. There is no finer scope yet, such as a read-only key.
Creating, listing and revoking keys happens only in the app, never through the API itself. A key that could mint keys would survive its own revocation, which is the one thing a leaked credential must not do.
When authentication fails
| Situation | Status | code |
|---|---|---|
| No header at all | 401 | unauthenticated |
| Key is malformed, unknown or revoked | 401 | unauthenticated |
| Key is valid but the plan does not include the API | 403 | forbidden |
A call with no key:
{ "error": { "code": "unauthenticated", "message": "missing Authorization: Bearer <key>" } }