Skip to main content
Airscale authenticates API requests with a workspace API key sent as a Bearer token.

​
Create an API key

Create the key in Airscale Settings: open the Airscale dashboard, choose Settings → API key, and generate a key for your integration. Store the value in your server’s secret manager or environment configuration:

​
Send the key

Include this header on every API request:

​
Job-change monitoring keys

Job-change monitoring requires a V2 workspace API key. Legacy V1 API keys are not supported by the /v1/job-change-monitors endpoints. Use the key from your V2 workspace; monitors and monitoring credits belong to that workspace. New hire monitoring (/v1/new-hire-monitors) and post engagement monitoring (/v1/post-engagement-monitors) have the same requirement: use a V2 workspace API key. An unknown key returns 401 with {"error": {"code": "invalid_api_key", "message": "The API key is not valid"}}.

​
Handle unauthorized requests

A missing Bearer token or an invalid API key returns 401 Unauthorized. Check that the header is present, that it starts with Bearer, and that your deployed secret contains the current key before retrying.
Keep API keys server-side. Never commit them to source control, place them in examples, or expose them in browser or mobile client bundles.

​
Rotate a compromised key

If a key is exposed, rotate it immediately in Airscale Settings. Update the server-side secret, deploy the new value, verify an authenticated request, and stop using the old key. Next, review Rate limits before adding request concurrency or retries.