Authentication

Every request to the API must include a valid Bearer API key. Keys are issued per workspace, are scoped to specific endpoints, and are hashed at rest — the plaintext is shown to you exactly once at creation.

Header

Text

Authorization: Bearer sk_bact_your_key

Scopes

A key carries one or more scopes. A call to an endpoint the key is not scoped for returns 403.

analyze — call POST /v1/analyze
stats — read usage statistics

Rotation & revocation

Revoke a key at any time from Settings → API Keys. Revoked keys immediately return 401. Create a new key before revoking the old one to rotate without downtime.

Keep keys secret

Never embed a key in client-side code or commit it to source control. Call the API from your backend only.