Skip to main content

​
API keys

All requests to api.framelane.io/v1/* must include an Authorization header — except POST /v1/signup, POST /v1/signup/verify, POST /v1/auth/sync, GET /v1/capabilities, and the system routes (/v1/health, /v1/ready, /v1/version):
You can create and manage API keys in the console under Settings → API Keys. Agents can provision a key without a human or a browser via POST /v1/signup → POST /v1/signup/verify (the returned key is gated until the emailed OTP is verified). See Self-provisioning for agents.
API keys are shown only once at creation time. Store them in a secret manager (e.g. AWS Secrets Manager, GCP Secret Manager, or a .env file excluded from version control).

​
Scopes

All API keys have full workspace access. Scoped keys with read-only or task-specific access are on the roadmap.

​
Rotating keys

  1. Create a new key in the console.
  2. Update your application to use the new key.
  3. Revoke the old key via DELETE /v1/api-keys/{key_id}.

​
Error responses

An invalid or missing API key returns:
Status code: 401 Unauthorized. A key that exists but whose workspace email is not yet verified returns 403 Forbidden with code: email_not_verified on every authenticated call until POST /v1/signup/verify succeeds.