Authentication
How to authenticate requests with API keys.
Send your API key as a bearer token on every request:
curl https://api.upsky.dev/v1/platform/team \
-H "Authorization: Bearer $UPSKY_API_KEY"Key types
| Prefix | Environment | Use it for |
|---|---|---|
upsky_test_ | Test | Development. No charges and no real checks run. |
upsky_live_ | Live | Production traffic. |
Keys belong to a team, so they keep working when a team member leaves.
Keep keys safe
- Only use keys on your server. Never ship one in a browser or mobile app.
- Store them in environment variables, not in your code.
- Replace a key straight away if it may have leaked.
Rotate a key
Create a new key, deploy it, then delete the old one. You can have more than one active key, so there's no downtime.
AI agents use OAuth instead of API keys. See MCP authentication.