Authentication and API keys

Send Authorization: Bearer YOUR_STEADYDO_API_KEY over HTTPS. Never send a key in a URL, source control, logs, screenshots, third-party prompts, or client-visible analytics.

Keys have scopes, optional expiry, revocation state, safe prefix/fingerprint, and debounced last-use metadata. A full-access key holds workspace:read, workspace:write, config:write, archive:write, destructive:write, and keys:manage. Required scopes are conjunctive.

createApiKey and rotateApiKey return a secret once. A successor may preserve or narrow the caller's scopes and expires no later than the caller. Validate the replacement before revoking the only usable key. Last-use timestamps are approximate because writes are debounced.

401 covers missing, malformed, invalid, expired, or revoked credentials without confirming key existence. 403 means a valid key lacks a required scope. Unknown and wrong-owner resources return the same non-enumerating 404.