Authentication and API keys

The AeroReply REST API lives at https://api.aeroreply.com/public/v1. Every request is authenticated with an API key that belongs to one workspace.

Create a key

Scopes

Send the key

Use the Authorization header. An x-api-key header is accepted too, for tools that can't set a Bearer token.

curl https://api.aeroreply.com/public/v1/me \
  -H "Authorization: Bearer ar_live_…"

GET /me needs no scope, so it is the quickest way to check a key. It returns the workspace and the key's scopes.

{
  "workspace": {
    "id": "cml0ws789",
    "name": "Acme Studio"
  },
  "scopes": [
    "read",
    "write"
  ]
}

Manage keys

• Disable a key with its switch. Requests fail until you switch it back on.
• Rotate secret issues a new secret. The old one stops working right away.
• Revoke permanently deletes access for good. This can't be undone.

Only the Owner, or a custom role with Manage members, can create or change keys. Requests run with the permissions of the person who created the key.