Authentication

The ywork API uses API keys to authenticate requests. Documentation is public, but every API call must be authenticated.

API keys

Create and manage keys under Settings → API keys in your workspace. A key carries the permissions of the workspace it belongs to, so keep it secret:

• Do not share keys in publicly accessible places (GitHub, client-side code, support tickets).
• Use separate keys for separate integrations so you can revoke one without affecting the others.
• Rotate keys periodically and immediately if one may have leaked.

Making authenticated requests

Send your key as a bearer token in the Authorization header:

curl https://docs.ywork.dev/api/v1/users/me \
  -H "Authorization: Bearer ywork_sk_live_2f8c1b9a4d7e6031"

All requests must be made over HTTPS. Calls made over plain HTTP, or without a valid key, fail.

Unauthenticated requests

If the Authorization header is missing or the key is invalid, the API responds with 401 Unauthorized:

{
  "error": {
    "type": "authentication_error",
    "code": "missing_api_key",
    "message": "No API key provided. Send your key as a bearer token in the Authorization header.",
    "request_id": "req_9f2a1c7b4e"
  }
}

See the Errors guide for the full error format.