Authentication

Three principals authenticate against the API. They differ in scope, and the server derives behavior from which one a request carries.

Platform API key

• HTTP header: Authorization: Bearer skp_…

Org-scoped; minted in the dashboard (Settings → API keys). Authenticates everything except end-user session creation.

Invocation API key

• HTTP header: Authorization: Bearer skp_…

Per-app; the key your frontend ships to end users. Scoped to one app (the app_id is minted with the key), and its only privilege is creating and talking to sessions of that app:

curl -X POST https://api.sectr.dev/sessions \
  -H "Authorization: Bearer $SECTR_INVOCATION_KEY" \
  -H "Content-Type: application/json" \
  -d '{"app": "support-agent", "route": "/chat", "input": {"message": "hi"}}'

A leaked invocation key is contained: it can’t read other apps’ sessions, touch secrets, or deploy. Rotate freely: new sessions use the new key, existing sessions live in the journal regardless.