Authentication
Authenticate every request with a workspace API key as a Bearer token.
Send your key in the Authorization header on every request:
GET /v1/me HTTP/1.1
Host: api.synqed.dev
Authorization: Bearer sk_live_us_…Keys look like sk_live_<region>_<secret>. The region (us or eu) tells you which base URL the key works against.
Keep keys secret
- API keys are server-side credentials. Never ship one in a browser bundle, a mobile app, or a public repository. The API does not send CORS headers, so browser calls fail by design.
- Store keys in a secret manager (Google Secret Manager, AWS Secrets Manager, Vault, Doppler, 1Password, …) and inject them as environment variables.
- Create one key per integration. Revoking one integration then never breaks another, and audit logs show exactly which integration did what.
Verify a key
GET /v1/me needs no permission and returns what the key can do:
{
"object": "api_key",
"id": "8f2c1d9e0b7a4c3f5e6d",
"name": "Notion sync",
"workspace_id": "acme",
"region": "us",
"permissions": ["documents:read", "documents:write"],
"access": { "visibility": "workspace", "groups": [], "sources": null },
"agent_id": "key_8f2c1d9e0b7a4c3f5e6d"
}agent_id is the principal the key acts as. Messages it sends, activity it logs, and records it writes are attributed to this id, and it appears on the workspace agent roster.
Authentication errors
| Status | code | Meaning |
|---|---|---|
| 401 | missing_api_key | No Authorization: Bearer header. |
| 401 | invalid_api_key | Malformed, unknown, expired, or revoked key. |
| 401 | wrong_region | The key belongs to the other region — the message names the right base URL. |
Rotation and revocation
- Rotate a key from Settings → API keys → ⋯ → Rotate secret. You can either cut the old secret off immediately or keep it working for 24 hours while you deploy the new one.
- Revoke a key to cut it off. Revocation takes effect within 30 seconds everywhere.
- Keys a member created are revoked automatically when that member is removed from the workspace. They are suspended while the member is demoted to viewer or has left every group the key covers (and work again if that changes), and narrowed when the member loses some of the key's groups. An admin can re-issue a workspace key.
- Disconnecting a key's principal in Settings → Agents revokes the key.
- Keys can carry an optional expiry (30 days, 90 days, 1 year) set at creation.