Authenticating API requests

All API requests require a Bearer token in the Authorization header. Generate a key from Settings → API → New API Key — keys are scoped to a single workspace.

Treat API keys like passwords: never commit them to source control, and rotate them immediately if one is ever exposed. You can revoke a key at any time with no downtime for other keys.