Authentication — developer API

Bearer token

The key goes in the Authorization header — on both surfaces, with no further headers. Calls without a valid key answer 401.

Authorization: Bearer $FUTUREWAY_API_KEY

Create and revoke keys under Settings → API & CLI. The plaintext is shown exactly once.

Two key kinds

A personal key acts as you. A service key is your organisation's machine identity and sees only what was explicitly shared with it.

	Personal key	Service key
Prefix	`sk-fw-api-…`	`sk-fw-svc-…`
Acts as	the person it belongs to — the same rights as in the browser	the organisation, no person
Sees	everything you see yourself	only resources an admin shared with the key
Scopes	fixed, never admin scopes	chosen at creation from the list below
Who creates it	every member with a platform seat	owners and admins
Lifetime	ends with the account; revoked on offboarding	survives staff changes; ends only by revocation or expiry

Scopes

A scope opens access to a family of endpoints. What is visible inside it is still decided by the platform's permissions — a scope is never a right to a particular resource.

Scope	Opens	Personal	Service
inference	Inference API: chat completions, embeddings, model list.	yes	yes
audit:read	Read the organisation's audit log (GET /v1/audit-events) — for a SIEM or an audit. Service keys only.	no	yes

Scopes are fixed at creation and can only be narrowed. More rights mean a new key. If a key lacks an endpoint's scope, the App API answers 403 scope_missing.

A service key appears in the share dialog of every shareable resource (agents, knowledge areas, prompts) as its own recipient — next to groups and members, visible to owners and admins only. Only with a share may the key see or use the resource through the API; revoking the key deletes its shares.

Expiry, rotation, revocation

Expiry at creation: 30 · 90 · 365 days — or no expiry
Expired key: 401 key_expired
Rotation: mints a new secret for the same key entry; scopes and expiry stay, the old plaintext is invalid immediately.
Revoked key: 401 unauthorized

Security rules

Server-to-server only: the API is not meant for calls from web pages or apps on end-user devices.
Keys live in environment variables or a secret store — never in source code, never in logs.
Requests with an Origin header, fetch metadata or a session cookie are rejected with 403.
One key per application and environment, with the fewest scopes it needs.

This is what the rejection of a browser request looks like:

{
  "error": {
    "code": "browser_request_rejected",
    "message": "The App-API accepts server-to-server requests with an API key only.",
    "request_id": "3f6c1c9e-0a4b-4c3e-9b0e-6a1d2f8e4b21"
  }
}