Authentication
Tenant API keys with explicit scopes.
Preview documentation. Details may change before the API is released.
Requests are authenticated with a tenant API key sent as a bearer token.
GET /api/v1/funds HTTP/1.1
Authorization: Bearer YOUR_API_KEY
Keys
- A key belongs to one workspace. It can never read another workspace's data.
- Each key carries explicit scopes. A request outside the key's scopes fails with
403. - Keys are created and revoked by a workspace owner or administrator in the fund portal. Creating a key requires step-up verification.
- A key is shown once, when it is created. Store it in a secrets manager. We store only a hash.
- Every use of a key is recorded in the workspace audit log.
Rotation
Create a second key, move your systems to it, then revoke the first. Revocation takes effect immediately.
What not to do
- Do not embed a key in a browser or mobile app.
- Do not email or message a key. If a key is exposed, revoke it and create a new one.