Authentication
How to authenticate API requests using API keys and session tokens.
Overview
All API requests must be authenticated. Amarsia supports two authentication methods:
- API keys — long-lived credentials for server-to-server use
- Session tokens — short-lived tokens for user-facing applications
API keys
API keys are the recommended method for server-side integrations. They are scoped to a workspace and carry a specific permission set.
Creating an API key
- Open your workspace Settings.
- Navigate to API Keys.
- Click Create key, give it a name, and select the required scopes.
- Copy the key immediately — it is shown only once.
Using an API key
Pass the key in the Authorization header as a Bearer token:
curl https://api.amarsia.com/v1/resources \
-H "Authorization: Bearer sk_live_..."Never expose API keys in client-side code or public repositories. Use environment variables.
Key prefixes
| Prefix | Environment |
|---|---|
sk_live_ | Live |
sk_test_ | Test |
Session tokens
Session tokens are issued after a successful user login and expire after 24 hours. Use them for authenticating requests made on behalf of a user.
curl https://api.amarsia.com/v1/me \
-H "Authorization: Bearer sess_..."Rotating keys
Rotate an API key immediately from Settings → API Keys → Rotate. The old key is invalidated and a new one is issued. Requests using the old key will receive 401 Unauthorized.