Authentication

Every request is authenticated with an API key, sent as a bearer token in the Authorization header:

curl https://api.summerbase.com/v1/project \
  -H "Authorization: Bearer sb_us1_k7hq2mxa_vq3nr8tw2yz5cf6hk2mp7sx4bd3gj5lq2wn6tr4yv7zc3fh5km2pq"

A key’s role decides what it may do: a viewer key reads, and a writer key writes as well. Everything a key writes is attributed to the source it is bound to. The secret is shown once, when the key is created. Keep it on a server: anyone who has it can do what the key can.

Keys are created and revoked in Summerbase, by an admin of the project, and never through the API. Revoking a key stops it working immediately, for every request after.

A request with no key, or with one that is mistyped or revoked, is refused with 401.