Authentication

Every request carries an API key. The key identifies both who is calling and which organization they are calling for.

Create a key

Keys are created from Settings → API keys. Give it a name that says where it runs — you will thank yourself when you need to revoke one of five.

A key looks like sk_live_81dd5820_YH4nBam1…. The middle segment is the prefix, which is the only part we can show you again.

The secret is displayed once, when you create it. We store only a hash, so it cannot be recovered — if it is lost, revoke that key and issue another.

Send it with every request

Headers

Key	Type	Sample	Description
Authorizationrequired	string	`Bearer sk_live_81dd5820_YH4nBam1…`	Your API key as a bearer token. The usual choice.
X-API-Keyoptional	string	`sk_live_81dd5820_YH4nBam1…`	Accepted instead of Authorization, for stacks where that header is awkward.
Content-Typerequired	string	`application/json`	Required on any request with a body.

curl

curl https://api.streamos.in/api/public/v1/livestreams/ \
  -H 'Authorization: Bearer sk_live_81dd5820_YH4nBam1…'

What a key can do

A key carries its organization’s full permission set. It is not tied to a person and cannot be narrowed to a subset of endpoints yet — treat it as equivalent to an administrator for that organization.

It is not an owner, though: actions reserved for the organization owner — the ones no role can be granted — stay closed to API keys.

Revoking

Revoke from the same settings screen. The key is checked against the database on every single request with no caching, so revocation takes effect on the very next call — there is no propagation delay to wait out.

after revoking

{
  "success": false,
  "message": "Invalid or expired API key.",
  "error": { "code": "INVALID_API_KEY" }
}

Rotating

Because only one key can be live, rotation is revoke-then-create — and there is a gap between the two where nothing authenticates. Plan for it: revoke, create the replacement, deploy it, and expect requests in between to return 401.

Keeping a key safe

Keep it server-side. Anything in a browser bundle or a mobile app can be read by whoever holds the device — that includes environment variables inlined at build time.

One key serves the whole organization, so every integration you run shares it. That makes the key worth guarding closely — revoking it to contain one leak takes every other integration down with it.

Missing, malformed, unknown, revoked and expired keys all return the same 401 INVALID_API_KEY. That is deliberate — distinguishing them would let someone confirm that a key once existed.