Authentication

Every request carries an API key in the Authorization header, in this form:

Authorization: silktide token=YOUR_API_KEY

There is nothing else to set up: no OAuth flow, no token exchange and no expiry. A key works until someone deletes it.

If something between you and Silktide already uses Authorization, such as a proxy that signs requests with its own credentials, send the same value in Silktide-Authorization instead. When both are present, Silktide reads Silktide-Authorization.

Silktide-Authorization: silktide token=YOUR_API_KEY

Always send the key in a header. Never put it in the address, where it ends up in logs and browser history.

Keys belong to one account and one region#

A key is created inside one Silktide account, and it can only reach that account. It also works only on its account's regional host: a European key sent to api.us.silktide.com gets 401, exactly as if it were wrong. See Find your region.

What a key can do#

A key can read and change the account the way an administrator can. An operation that needs a permission says so under Access on its page, and returns 403 with the type AccessDenied when the key does not have it.

Keep keys secret#

• Keep keys on your servers. Never put one in JavaScript that runs in a visitor's browser, in a mobile app, or in a public repository.
• Use one key per script or service, named for it, so you can delete one without breaking the others.
• Delete a key the moment you think it has leaked, in Settings, then API. Anything using it stops at once.

Replace a key#

Keys never expire, so replace them on your own schedule, or when someone who knew one leaves:

1. Create a new key in Settings, then API.
2. Put it wherever the old key is used, and check those requests succeed.
3. Delete the old key.

Both keys work in between, so nothing has to stop while you switch.

When a key is refused#

A refused key gets 401 with this body:

{
  "error": {
    "type": "NotLoggedIn",
    "message": "Not logged in",
    "properties": []
  }
}

Check, in order:

1. The header is spelled silktide token=, with the space and the equals sign.
2. You are calling your account's region.
3. The key has not been deleted.