Skip to main content
Send the API key as a bearer token on every request:
Each key belongs to exactly one organisation, fixed when the key is created. Clients never send an organisation ID and cannot reach another organisation’s data: every lookup is scoped to the key’s organisation, and IDs from other organisations return 404. RaiseGate stores only the SHA-256 hash of the key. Any other Authorization scheme (for example Basic) returns 401.

​
Scopes

A missing scope returns 403 insufficient_scope. Keys issued by the provisioning script carry all four scopes. A narrower key (for example a read-only reporting key with tracker:read and leads:read) is created by inserting a partner_api_keys row with fewer scopes. On the MCP server, a tool the key is not allowed to use returns a tool error with insufficient_scope. The rest keep working.

​
Issuing and revoking keys

The command prints the plaintext key once. Transfer it through a secrets manager, not email or chat. Revoke a key by setting revoked_at on its partner_api_keys row. Revoked and expired keys return 401 unauthorized. last_used_at is updated on every authenticated request.
Use a dedicated key per assistant or agent so usage, limits, and revocation are isolated.