Authentication

All endpoints require your organisation's API key sent in the X-API-Key header.

Getting an API Key

1. Log in to the EK Hub dashboard
2. Navigate to Settings > API Keys
3. Click "Create API Key"
4. Copy the key — it's only shown once

Using the API Key

Include the X-API-Key header in every request:

curl -H "X-API-Key: api_a1b2c3d4e5f6..." \
  http://localhost:3002/agents

const response = await fetch('http://localhost:3002/agents', {
  headers: {
    'X-API-Key': 'api_a1b2c3d4e5f6...'
  }
});

import requests

response = requests.get(
    'http://localhost:3002/agents',
    headers={'X-API-Key': 'api_a1b2c3d4e5f6...'}
)

Security Best Practices

• Store in environment variables — never hardcode in source code
• Each key is scoped to one organisation — it can only access that org's agents and sessions
• Set expiry dates — rotate keys regularly
• Revoke compromised keys immediately from the dashboard

Error Responses

If the API key is missing or invalid, you'll receive:

{
  "error": "Unauthorized. API key is missing or invalid."
}