Authentication
All /v1/* endpoints authenticate with your project API key, sent as a
Bearer token:
http
Authorization: Bearer apk_test_your_key_here
Where to get a key
- Sign in to the dashboard.
- Open your project.
- Go to API Keys and create one.
Each key is scoped to exactly one project. The resolved context — key → project → organization — is what every request is authorized against, so a key for project A can never see project B's files.
Key lifecycle
| State | Behavior |
|---|---|
test keys | For development. Identical endpoints to live keys. |
live keys | For production traffic. |
| Revoked keys | Immediately rejected with 401 UNAUTHORIZED. |
| Expiring keys | Pass an optional expiresInDays at creation. |
Use /v1/me as a configuration sanity check:
bash
curl https://api.apulodi.com/v1/me \
-H "Authorization: Bearer $APULODI_API_KEY"
json
{
"project": { "id": "prj_…", "name": "My App", "slug": "my-app" },
"organization": { "id": "org_…" },
"apiKey": { "id": "key_…", "name": "ci", "environment": "test" }
}
Key safety
- Keys are secrets. Never commit them to source control.
- The SDK is intended for server-side use only. Bundling an API key into browser JavaScript exposes it to every visitor.
- APULODI never logs the full key — only its prefix.
- Rotate a key by revoking it and creating a replacement.
Common errors
| Status | Code | Why |
|---|---|---|
401 | UNAUTHORIZED | Missing, malformed or revoked Authorization header. |
400 | VALIDATION_ERROR | Malformed JSON or invalid request body. |
Next: read the API overview for conventions and the error envelope.