Authorization header. The API
picks an identity resolver from the header’s prefix.
API keys
The right choice for server-to-server work.Create one
1
Open the dashboard
Go to the Sapt dashboard. No account yet?
Sign up.
2
Open your account
Click your profile in the bottom left → Account.
3
Create the key
Click Create API Key and copy it. Keys start with
sapt_.Use it
The prefix is
ApiKey, not Bearer. A key sent as Bearer falls through to
the OAuth token resolver and fails with 401.projectId outside that scope
returns 403.
Connector OAuth
Claude and ChatGPT use OAuth when you add Sapt as a connector. Point them at:OAuth2 clients
When you need to act across multiple Projects on a user’s behalf — an integration that lets agencies onboard their own clients, say — register an OAuth2 client and use the standard authorization-code grant.
Send the resulting access token as a bearer token:
/auth/me returns the authenticated user’s identity — the usual first call to
discover which Projects a token can reach.
Session cookies
Browser clients on a Sapt origin are authenticated by session cookie automatically. No header is needed. This path is for first-party dashboard code, not for integrations.WebSocket connections
For long-lived streams and custom clients, credentials are exchanged for short-lived JWTs at the connection layer. Supported connector clients handle this transparently.Permissions
Authentication resolves who you are; authorization is checked per endpoint against the Project’s role and permission model. A valid credential with insufficient permission on that Project returns403 FORBIDDEN — reading social
accounts, for example, needs social:read.