Authentication and API keys

Credentials

Every API takes a bearer credential in the Authorization header. The prefix tells you which kind it is.

Never put Supabase secret or service-role keys, Paddle API keys or Sent keys in browser or integration client code. Store API keys in your tool’s secret store, and keep pxu_ and pxk_ keys on your server.

Personal API keys (Customer API)

Create a personal API key in Passkey-X → Developers → API keys (scoped, expiring, optional IP allowlist). In the app's console you can also use your own session. Rate limit: 120 requests per minute per key (or per account for a session).

1. Open your account menu (top right) › Developers & API › API keys and choose Create key.
2. Name it after the script that will use it, choose what it may do (for example Vault items: Read, Change feed: Read) and how long it lasts.
3. Add the IP addresses it will be used from (Add my address fills in this computer). A leaked key then doesn't work anywhere else.
4. Copy the key (pxu_…) into your secret manager: it's shown once. Then try GET /v1/me in Developers › Console, or download the Postman collection.
5. Watch each key's Activity, and revoke a key the moment you don't need it.

export PASSKEY_X_PERSONAL_KEY='pxu_…'

curl -s https://passkey-x.com/api/v1/me -H "Authorization: Bearer $PASSKEY_X_PERSONAL_KEY"

# → { "credential": "personal_api_key", "your_ip": "203.0.113.24", "key": { "scopes": ["vault:read", "sync:read"], … } }

Personal key scopes

A personal key can hold any of these; /v1/me, /v1/item-types and /v1/api-keys need none. Up to 10 active keys (and 5 test keys) per person.

A key without the scope an endpoint needs is answered 403 insufficient_scope, with the missing scope in WWW-Authenticate.

Organization API keys

Admin console → Integrations → API keys. Use a short-lived, read-only key for testing. Rate limit: 300 requests per minute per key.

1. Open Admin console › Company & billing › Integrations & API keys and create a key with only the scopes the tool needs (for example members:write or audit:read).
2. Copy the key once and store it in your tool's secret store. It starts with pxk_.
3. Call the API with Authorization: Bearer <key>. The full reference, with examples, is at passkey-x.com/api-docs. Its “All endpoints at a glance” table lists every endpoint with the scope it needs.
4. Revoke a key at any time; every call is recorded in Logs (type: API calls) with the key, the address and the result.

export PASSKEY_X_API_KEY='pxk_…'

curl -s 'https://passkey-x.com/api/org/v1/me' -H "Authorization: Bearer $PASSKEY_X_API_KEY"

Organization key scopes

Give each integration only what it needs. A key can hold up to 40 scopes, and an organization can have 20 active keys. A missing scope is answered 403 forbidden.

Test keys and IP allowlists

• Test keysOne click in Developers (personal) or the Admin console (organization): read-only and expire after one hour. Use them in consoles, Postman and while you build.
• IP allowlistsLimit a personal or organization key to your servers’ addresses. Calls from anywhere else are answered 403 ip_not_allowed. GET /v1/me returns your_ip, the address the API sees.
• New-address emailThe owner is emailed the first time a key is used from a new IP address. If that wasn’t you, revoke the key.
• Expiry and revocationKeys expire after 1–365 days and can be revoked at any time. Passkey-X keeps only a hash: a key is shown once.

Agents and SCIM

Agent tokens (pxa1.) authenticate the Agent API: The one-time agent token from Admin console → Agents. SCIM tokens (pxscim_) authenticate your identity provider’s SCIM 2.0 connection.