Skip to main content
This page is the prose half of the API: how a key authenticates, what it is allowed to reach, and how to page and fail well. The API reference is the generated half, listing every operation with a runnable example.

​
Authentication

Every request carries a key as a bearer token. Create one in Settings > Developer.
A key acts as a member of your workspace and can never perform admin actions. It cannot create or run listeners, change billing, or create another key. That holds regardless of who created it.

​
Permissions

A key reaches only what its scopes allow, and anything not granted is refused. There is no scope that grants admin access. Every list endpoint is scoped to the workspace its key belongs to. You never name an organisation: the key determines it.

​
Pagination

List endpoints return a page and a cursor. Pass the cursor back as cursor to get the next one.
nextCursor is null on the last page, not absent — the field is always there, so stop when it is null rather than when it is missing. Do not stop on an empty items either: a full page can still be the last one, and the only reliable end-of-list signal is the null. The cursor is opaque. It encodes the sort value and the row id so pages stay stable while new rows arrive at the head of the list; nothing in it is a public format, so pass it back as given rather than constructing or parsing one. A cursor the server cannot read is ignored and you get the first page again. limit sets the page size on every list endpoint: 1–200, defaulting to 50. Values outside that range are clamped rather than refused, so ?limit=5000 answers 200 rows and a 200, not a 400.

​
Errors

Two status codes are worth handling apart from the rest, because they look similar and want opposite responses. A 402 means the workspace’s plan does not include something, and the answer is to upgrade. A 429 means it does, but not yet: those carry a readyAt telling you when to retry. Retrying a 402 will never succeed.

​
If a key leaks

Revoke it in Settings > Developer. It stops working within a minute, and immediately for the API’s own cache. Revoked keys stay in the list rather than being deleted, because the record that a key existed is what you need when working out what it touched.
Only a hash of each key is stored, so a lost secret cannot be recovered or shown to you again. Revoke it and create another.

API reference

Every operation, generated from the routes a key can actually call.

Webhooks

Be told when something happens, instead of polling these endpoints for it.

MCP & Agents

The same data for an assistant, over OAuth rather than a static key.

Workspace and settings

Where keys are created, and why one is never an admin.