Authentication

Send your workspace API key with every request as Authorization: Bearer <key>. X-API-Key: <key> works too.

• Keys start with st_live_ and belong to one workspace. A workspace can have 10.
• A Read only key starts with st_read_: it reads everything and changes nothing. A change with it answers 403 read_only_key. Choose Full access or Read only when you create a key; to change it, make a new key.
• Rename or revoke a key in Settings. Revoking it also removes the webhooks it subscribed.
• Keep keys in your tool’s secret storage, never in a page or an app people download.