Browse the docs

Authentication

API keys, scopes, and how a key is tied to a workspace.

On this page
  1. Create a key
  2. Scopes
  3. Workspace-bound and organisation-wide keys
  4. Limits
  5. What keys cannot do

Every request to https://api.statusbee.co/user/* carries a bearer token in the Authorization header. For integrations that token is an API key. The dashboard uses the same endpoints with a session token, so anything you can do in the dashboard you can do with a key that has the right scope.

Request
curl "https://api.statusbee.co/user/workspaces" \
  -H "Authorization: Bearer sb_live_…"

Create a key

Keys are created in the dashboard under Settings, API keys, or with the API keys endpoints. Each key has a name, a scope, and optionally a workspace. The raw key is shown exactly once; only a hash is stored, so a lost key must be revoked and replaced.

Keys start with sb_live_. Keys from a test environment start with sb_test_.

Scopes

ScopeGrants
readEvery read permission on the key's workspace: pages, components, incidents, maintenance, monitors and their checks, subscribers (masked), analytics, the audit log.
writeEverything, including creating incidents, changing component status, managing monitors, pages, subscribers and webhooks.

A key can have both scopes. There is no finer-grained scope; if you need a key that can only post incidents, create it in a workspace that only holds the relevant page.

Workspace-bound and organisation-wide keys

A key created with a workspace_id acts inside that workspace only. A key created without one is organisation-wide and must say which workspace each request is for, with the X-Workspace-Id header:

Organisation-wide key
curl "https://api.statusbee.co/user/incidents?workspace_id=5" \
  -H "Authorization: Bearer sb_live_…" \
  -H "X-Workspace-Id: 5"

Requests for a workspace the key's organisation does not own answer 404, the same as a workspace that does not exist.

Limits

The number of keys per organisation depends on the plan: none on Free, three on Starter, ten on Team. Revoked keys do not count. Creating a key past the limit answers 403 with the code PLAN_LIMIT.

What keys cannot do

  • Start a checkout or change billing. Those need a signed-in person.
  • Invite or manage team members.
  • Read another organisation's data, under any circumstances.
Treat a key like a password. Send it only over HTTPS, keep it out of client-side code, and revoke it the moment you think it has leaked. Revocation is immediate.