Skip to main content
Every endpoint in this reference requires an Authorization header. The API picks an identity resolver from the header’s prefix.

​
API keys

The right choice for server-to-server work.

​
Create one

1

Open the dashboard

Go to the Sapt dashboard. No account yet? Sign up.
2

Open your account

Click the round button with your initials in the top bar, then Account.
3

Create the key

Open API Keys (under Developer), click Create API Key, and copy it. Keys start with sapt_.
An API key is shown only once. Put it in an environment variable, and never commit one to source control.

​
Use it

The prefix is ApiKey, not Bearer. A key sent as Bearer falls through to the OAuth token resolver and fails with 401.
Keys are Project-scoped: every operation is restricted to resources inside the Projects the key was issued for. Calling a projectId outside that scope returns 403.

​
Connector OAuth

Claude and ChatGPT use OAuth when you add Sapt as a connector. Point them at:
Sign in with your Sapt account when the client prompts you. Sapt uses your account permissions to decide which Projects and tools the connector can reach, so you never paste an API key into Claude or ChatGPT for normal connector setup. See Connect Claude or ChatGPT for the click-through.

​
OAuth2 clients

When you need to act across multiple Projects on a user’s behalf (for example, an integration that lets agencies onboard their own clients), register an OAuth2 client under Account > OAuth Clients and use the standard authorization-code grant. Send the resulting access token as a bearer token:
/auth/me returns the authenticated user’s identity. It is the usual first call to discover which Projects a token can reach.

​
Session cookies

Browser clients on a Sapt origin are authenticated by session cookie automatically. No header is needed. This path is for first-party dashboard code, not for integrations.

​
WebSocket connections

For long-lived streams and custom clients, credentials are exchanged for short-lived JWTs at the connection layer. Supported connector clients handle this for you.

​
Permissions

Authentication resolves who you are; authorization is checked per endpoint against the Project’s role and permission model. A valid credential with insufficient permission on that Project returns 403 FORBIDDEN. Reading social accounts, for example, needs social:read.