Skip to main content

Authentication

Your workspace has a single server secret key (it starts with sk_live_). It authenticates every server-side call you make to Syft:

It is a workspace-level key, not a per-user one. Anyone with access to the workspace settings sees the same key.

It is not the public tag key in your website snippet. See Your two keys.

Where to find it​

Go to /dashboard/settings/snippets. The API Secret Key card shows the key's prefix, when it was last rotated, and when it was last used.

Click Reveal to see the full key, then copy it.

Plan

API access is included on the Starter and Pro plans. See Credits & Usage.

Generating a key​

Every workspace is issued a key when it is created, so in most cases there is nothing to generate — just reveal the existing one.

If the card shows no key (older workspaces predate automatic issuing), click Generate key. The full key is shown once in a confirmation dialog. Copy it then; afterwards you can still reveal it from the same card.

Rotating a key​

Click Rotate on the API Secret Key card. This mints a new key and invalidates the old one immediately.

Anything still using the old key stops working as soon as you rotate, so plan for it:

  1. Rotate the key and copy the new value from the dialog.
  2. Update every place the old key is stored — your server environment variables, your MCP client config, any scheduled jobs.
  3. Confirm your integrations are working again.

Using the key​

Pass it as a bearer token in the Authorization header:

Authorization: Bearer sk_live_...

For example:

curl https://app.syftdata.com/api/motion/<motion-id>/export \
  -H "Authorization: Bearer sk_live_YOUR_SECRET_KEY"

The Lookup API, the Export API and inbound webhook URLs also accept the key in these ways:

MethodExample
x-syft-secret-key headerx-syft-secret-key: sk_live_...
secretKey field in a JSON request body (POST requests){ "secretKey": "sk_live_..." }

A missing or invalid key returns 401. See Errors.

Keeping it safe​

The key grants access to your workspace's data, so treat it like a password:

  • Store it in a secret manager or environment variable, never in client-side code or a public repository.
  • Do not paste it into shared documents or chat threads.
  • Rotate it if you think it has been exposed.

Ask Syft​

Ask Syft can bring the API Secret Key card straight into the chat — ask "where is my API key?" or "how do I generate an API key?" and it will render the card with its reveal and copy controls. It will never print the key itself into a message.