Authentication

API keys

Every request to Authpipe’s authenticated endpoints requires an API key. Workspaces have two key types:

Role	Prefix	Access
Secret	sk_	Full API access — all endpoints
Publishable	pk_	Auth session creation only (createAuthSession, createInstallSession)

Use secret keys server-side only. Publishable keys are safe to include in client-side code.

Authentication header

Pass your API key as a Bearer token:

Authorization: Bearer sk_your_secret_key

Or with the SDKs:

const authpipe = new Authpipe({ apiKey: "sk_..." });

Managing API keys

Create a key

const result = await authpipe.createApiKey("Production", "secret");
// result.key — full key, only returned once
// result.id  — key ID for management

List keys

const keys = await authpipe.listApiKeys();
// Returns metadata only (id, name, role, created_at) — never the key itself

Revoke a key

await authpipe.revokeApiKey("key_abc123");

Revoked keys are immediately rejected. Revocation is permanent.

Rate limits

Rate limits vary by workspace tier:

Tier	Requests per minute
Free	60
Pro	600
Enterprise	Custom

When rate limited, the API returns 429 Too Many Requests. All SDKs automatically retry with exponential backoff.

Public endpoints

Some endpoints don’t require authentication:

Endpoint	Description
GET /providers	Browse the provider catalog
GET /providers/{id}	Get provider details
GET /providers/categories	List categories
POST /auth-sessions	Create OAuth auth session (with publishable key)
POST /install-sessions	Create install session (with publishable key)
GET /oauth/callback	OAuth callback (Authpipe handles this)
POST /webhooks/{provider}	Inbound provider webhooks