Authentication and API keys
Every /v1 request carries a bearer API key that reaches one account's data.
Every /v1 request needs an API key in the Authorization header:
Authorization: Bearer <api-key>
(RFC 6750). GET /healthz is the
only endpoint without one.
- Keys belong to one account and can only read and write that account’s data.
- We store a hash of each key, never the key itself, and never log it.
- Rotate a key in Settings › API keys: create the new key, deploy it, then revoke the old one. Both work until you revoke.
- Dashboard sign-in for Enterprise accounts can use SAML SSO (beta from 2026-12-10).
How we think about API security: the OWASP API Security project. Report a vulnerability to your account owner; we answer within one business day.