Authentication

Create a key

Keys are made in the app, at Settings › API keys, on the Pro and Ultra plans. Name it after whatever will be using it — the name and the last-used date are what make it safe to delete later.

The key is shown once. We store a SHA-256 hash of it, so nobody can show it to you again, us included. If you lose it, delete it and make another. You can have five at a time.

There is no endpoint that creates keys, deliberately: a key that can mint keys cannot be contained, because revoking the leaked one is pointless once it has made three more.

Send it

Every request carries the key in an Authorization header. There is no other accepted form — no query parameter, and the app’s session cookie is ignored here, because a browser attaches cookies by itself and an API that honoured them would be reachable from any page you happened to have open.

curl "https://api.slashtrace.com/v1/status" \
  -H "Authorization: Bearer $API_KEY"

Keep it out of your source. An environment variable, a secrets manager, anything but a committed file — a key in a repository is a key in everyone’s clone of that repository.

What a key can do

Everything you can do to your own boards: read them, read the roles on them, add a board and remove one. Keys are not scoped — there is no read-only key today, so treat every one of them as able to delete a board.

It cannot reach anything else. A key has no access to:

• billing, payment details or your plan
• any account but yours
• admin functions of any kind
• creating or deleting keys, including itself

When a key stops working

• You deleted it. Immediate, and there is no undo — the hash is gone. Requests get 401 unauthorized.
• Your plan dropped to Free. Existing keys survive and every request gets 403 plan_required until you upgrade, at which point they work again with nothing to recreate. You can still see and delete them on Free — a downgrade must never leave you unable to revoke a key — but you cannot create new ones.
• Your email became unverified, which a change of address does. 403 email_not_verified until you confirm the new one.

Keys do not expire on their own and there is no rotation endpoint. To rotate: create the new key, deploy it, then delete the old one — in that order, so nothing is down in between.