API keys and authentication

Create keys in API Keys. Use the narrowest credential type and permission scope available for the workload.

Send a key

Use the bearer header over HTTPS:

curl "https://api.answerplane.com/health" \
  -H "Authorization: Bearer $ANSWERPLANE_API_KEY"

Store the key in a server-side secret manager. Never commit it, log it, place it in a URL, or send it to browser code.

Scope and lifecycle

Name keys by workload and environment, assign an owner, and avoid sharing one key between services. Rotate periodically and immediately after suspected exposure. Revoke unused keys.

Some endpoints accept authenticated user sessions while integrations use organization or source-scoped keys. Check the live API reference for the exact endpoint contract.

Tenant context

Where required, send the validated tenant identifier specified by your integration. A tenant header does not grant organization access and cannot expand the key's permission.