API keys
Workspace API keys let services call the Corvia Labs API without a browser session. Keys are created under Manage → API Keys in the app.
Key shapes
| Prefix | Environment |
|---|---|
sk_live_ | Production-style workspace key |
sk_test_ | Test-style workspace key |
The secret is shown once at creation. Store it in your secret manager; the UI will not reveal the full value again.
Authentication
Send the key as a Bearer token (or the product’s documented API-key header) on requests to:
text
https://corvialabs.com/api/...Auth accepts either a Clerk JWT (from the signed-in app) or a workspace API key. Both resolve to a user/workspace context; Personal workspace is ensured as needed.
Practical notes
- Prefer the narrowest role that can do the job (workspace members have role-based write permissions)
- Rotate keys if they leak; revoke unused keys
- Browser app traffic should keep using Clerk sessions — API keys are for server-to-server use