Get started
Authentication and access
Understand member keys, workspace boundaries, restrictions, expiration and safe rotation.
Send a bearer key
Authenticated endpoints accept Authorization: Bearer <API_KEY>. Keys start with sqk_, followed by 64 hexadecimal characters. A key is bound to its owner and workspace; there is no workspace selector in the request.
- Use the key on your server. This API does not send CORS headers.
- Never put a key in client-side JavaScript, a URL, source control or a public log.
- Use HTTPS and keep development and production keys separate.
Scope the integration
Choose restrictions when you create a key. They apply on top of its owner’s current permissions.
| Restriction | Behaviour |
|---|---|
| Access | read or write (read and write). POST /query is a read operation. |
| Resources | An explicit allowlist, or all catalog resources. Association operations require both sides. |
| IP addresses | Optional IP/CIDR allowlist for your server’s outbound addresses. |
| Expiry | Required. The app offers a lifetime of at most one year. |
Rotate and revoke
The secret is shown once; Squario stores a hash. Create a replacement key, update your integration’s secret, verify it with /me, then revoke the old key in Settings → API. Name keys after the integration so usage and changes are easy to recognise.
- Expired and revoked keys stop working.
- Removing the owner’s API permission or changing the plan can stop an existing key immediately.
- A membership becoming inactive revokes its keys. Reactivating the membership does not restore them.
- Expiry reminders are scheduled 14 and 3 days before expiry, subject to the owner’s notification preferences and the key’s lifetime.
When MFA changes
A key delegates the sign-in assurance of the session that created it. If a newly verified MFA factor makes that assurance stale, requests return 401 key_assurance_stale. Sign in with fresh MFA and create a replacement key.
API access and administration
api.access permits members to create and use their own keys. api.manage permits administrators to view and revoke members’ keys and inspect workspace-wide usage. API access is available on Pro, Growth, Scale and Enterprise. Permissions and the plan are checked again on every request.