Authentication and key safety

Create, store, rotate, and recover sandbox API credentials without losing tenant data.

Bearer authentication

API keys are shown once and stored only as hashes by Agsemble. Do not embed a production key in a mobile application or source repository.

Authorization: Bearer ag_test_...

Recovery kit

A new sandbox returns api_key_id and recovery_code alongside the key. A successful recovery replaces both secrets while preserving fields, observations, usage, and billing identity.

Rotate an exposed key

const replacement = await agsemble.apiKeys.rotate();
// Save replacement.api_key before continuing.