Back to Home
Dashboard

Authentication

Secure your API requests with Bearer token authentication

Security Required
3 min read

API Key Format

Understanding the structure of API keys

One key for everything

Your workspace API key — sk-workspace_… — authenticates every endpoint documented on this site: chat, leads, and webhooks (/api/v1/chatbots/{chatbotId}/…). It covers all chatbots in the workspace it was created in.

How to get your workspace API key

  1. Open your workspace in the dashboard.
  2. In the left sidebar, expand Workspace Setup and click API Keys.
  3. Click Create API Key, name it, and copy the generated sk-workspace_… value.

The full key is displayed only once — at creation. After that, only a masked preview is shown. If you lose it, create a new key and revoke the old one from the same page.

Key Structure

sk-workspace_[random_string]
sk-Secret Key prefix
workspace_Workspace identifier

Example API Key

sk-workspace_•••••••••••••••••••••••••••••••••••••••••••••••••
64
Total Characters
51
Random String
∞
Never Expires

Using Your API Key

Include the key in the Authorization header of every request

Authorization Header

Authorization: Bearer sk-workspace_your_api_key_here

Complete Request Example

curl -X GET "https://pollybot.app/api/v1/chatbots/your-chatbot-id/leads" \
  -H "Authorization: Bearer sk-workspace_your_api_key_here" \
  -H "Content-Type: application/json"

✓ Correct Usage

Include "Bearer " prefix
Use HTTPS in production
Store in environment variables

✗ Common Mistakes

Missing "Bearer " prefix
Exposing key in client-side code
Committing keys to version control

Security Best Practices

Keep your API keys safe and secure

Environment Variables

Store keys in environment variables, not in code

# .env file
API_KEY=sk-workspace_your_api_key_here

# In your code
const apiKey = process.env.API_KEY;

Server-Side Only

Never use API keys in frontend JavaScript, mobile apps, or any client-side code.

Rotate Regularly

Generate new API keys periodically and update your applications.

Monitor Usage

Keep track of API key usage in your workspace dashboard.

🚨 If Your Key is Compromised

1. Immediately delete the compromised key from your workspace

2. Generate a new API key

3. Update all applications using the old key

4. Monitor for any unauthorized usage

Authentication Errors

Common authentication error responses

401 Unauthorized - Missing API Key

{
  "success": false,
  "error": "Missing authorization header",
  "code": "MISSING_AUTH_HEADER"
}

401 Unauthorized - Invalid API Key

{
  "success": false,
  "error": "Invalid API key",
  "code": "INVALID_API_KEY"
}

401 Unauthorized - Malformed Header

{
  "success": false,
  "error": "Malformed authorization header. Expected format: Bearer <token>",
  "code": "MALFORMED_AUTH_HEADER"
}
Authentication Configured!

Now that you understand authentication, learn about rate limiting and explore the available API endpoints.

Rate LimitingAPI Endpoints