Authentication
Use organization-owned API keys as bearer tokens for server-to-server automation.
Bearer keys
Send Authorization: Bearer sk_live_... on every request. The x-api-key header is also accepted for integrations that cannot set bearer authorization. API keys are intended for servers and automation workers, not browser clients.
Create keys in Settings -> Connected apps -> API keys. Only the Owner or an Admin can create, rotate, or revoke a key. A key is shown once at creation time; copy it then, because it cannot be retrieved again.
Set an expiration when creating a key: Never, 30 days, 90 days, or 1 year. Rotating a key keeps the old key valid for an overlap window you choose (1 hour, 24 hours, or 7 days) so callers can switch over without downtime.
Failures
Missing, invalid, expired, or revoked keys return 401. A valid key rejected by its IP allowlist returns 403.