Authentication

Use either supported header:

apikey: YOUR_API_KEY

Authorization: Bearer YOUR_API_KEY

Use your workspace API key as the Bearer token.

Send your key in a header to keep it out of URLs. The API also accepts an apiKey query parameter or JSON body field. When multiple credentials are supplied, the first valid token wins in this order: apikey, Bearer, query, body. An invalid candidate does not block a valid token in another location. Only the first valid key is used.

Workspace accessCopy Anchor Link

API keys allow all public API operations in their workspace.

The key fixes the workspace for every request. Do not supply a workspace ID. The creating user's membership must remain active. Expired and revoked keys cannot authenticate. Only owners/admins can manage keys in Settings.

View onceCopy Anchor Link

The full key is returned only at creation. Lists contain metadata, not the credential, and there is no reveal endpoint. Losing the creation response means creating a replacement and revoking the unusable key. Rotation creates a new key, deploys it in the calling application, then revokes the old one.

Treat recording links and invitation URLs as access credentials too. Do not log them or send API keys from public client-side code.