Authentication

Every API request must include your workspace API key as a Bearer token in the Authorization header. Keys always start with sk_live_. There is one API key per workspace - all requests made with it operate within that workspace's scope.

Authorization: Bearer <your-api-key>

---

Getting Your API Key

1. Log in to your Sarufi workspace
2. Navigate to Settings → API Keys
3. Click Generate API Key
4. Copy the key - it will only be shown once

Keep your key secret

Treat your API key like a password. Never expose it in client-side code, public repositories, or logs. Regenerate it immediately if it is compromised.

---

Using the Key

Include the key in every request header:

curl -X GET https://developers.sarufi.io/api/dev/v1/me \
  -H "Authorization: Bearer sk_live_your_api_key_here"

import requests

headers = {
    "Authorization": "Bearer sk_live_your_api_key_here",
    "Content-Type": "application/json",
}

response = requests.get(
    "https://developers.sarufi.io/api/dev/v1/me",
    headers=headers
)
print(response.json())

const response = await fetch("https://developers.sarufi.io/api/dev/v1/me", {
  headers: {
    "Authorization": "Bearer sk_live_your_api_key_here",
    "Content-Type": "application/json",
  },
});
const data = await response.json();

---

Verifying Your Key

Use the GET /me endpoint to verify your key is valid and see which workspace it belongs to:

curl -X GET https://developers.sarufi.io/api/dev/v1/me \
  -H "Authorization: Bearer <your-api-key>"

Response

{
  "workspace": {
    "id": "01JMXYZ...",
    "name": "Lorem Workspace",
    "plan": "pro"
  },
  "api_key": {
    "key": "sk_live_...",
    "created_at": "2026-01-15T10:00:00Z",
    "last_used_at": "2026-02-20T08:30:00Z"
  }
}

---

Authentication Errors

If your key is missing, malformed, expired, or invalid, you receive a 401 Unauthorized response. All error bodies have the same shape:

{
  "detail": "Invalid or expired API key"
}

Status	detail	When
401	Authorization header missing	No Authorization header
401	Invalid API key format	The key does not start with sk_live_
401	Invalid or expired API key	Unknown, revoked or expired key
401	Workspace not found or inactive	The key's workspace is gone or inactive
404	Chatbot not found	The chatbot does not exist, is inactive, or belongs to another workspace

Request body validation errors (422) return detail as a list of field errors instead of a string.

Ensure:

• The Authorization header is present on every request
• The value starts with Bearer (note the space)
• The key starts with sk_live_
• The key has not been regenerated since you last copied it