API keys

API keys

The kit supports two scopes of API keys:

• Personal keys (prefix sk_user_…) — tied to a single user. Use these for scripts you control yourself.
• Organization keys (prefix sk_org_…) — tied to an organization. Survive user offboarding. Owners and admins of an org can issue them at /<orgSlug>/settings/api-keys.

Creating a key

Navigate to Account → API keys (personal) or Settings → API keys (org-scoped). The raw key is shown once at creation. Save it; you cannot retrieve it later.

Using a key

Send Authorization: Bearer <key> on requests to JSON API endpoints:

curl https://your-saas.example.com/api/account/export \
  -X POST \
  -H "Authorization: Bearer sk_user_abc123..."

fetch("/api/account/export", {
  method: "POST",
  headers: { Authorization: `Bearer ${process.env.SAAS_API_KEY}` },
})

Scopes

• Page routes (HTML, /account/*, /admin/*) reject API keys.
• Admin routes (/admin/*) reject API keys even when otherwise valid.
• API keys cannot be issued or used under an active admin impersonation.

Revoking

Click Revoke on the API keys page. The key is invalidated immediately; subsequent requests with it return 401.