Authenticating

Every request carries an API key in the Authorization header:

Authorization: Bearer eksis_sk_...

A tool that asks for a header name and value can send the key alone in an X-API-Key header instead.

Create a key on the API page of the workspace it should reach. A key belongs to one workspace and cannot be pointed at another, so the workspace is never part of a request.

Keys are shown once, at creation. eksis stores only a hash, so a key that is lost is replaced, not recovered. Treat one like a password: server-side only, never in a browser, an app bundle, or a repository.