Skip to main content
Everabyte has two authentication surfaces. They do not substitute for each other. This documentation covers the first. The second is handled by the application and is not a public API contract.

​
API key headers

Every request to the developer API must include both headers:
Example:
The server verifies the pair cryptographically. Key prefixes are not trusted as proof of anything.

​
What the key represents

An API key authenticates a company context. Requests act on that company’s buckets, folders, and files. The key may also be assigned to a specific member, in which case the effective user context is that member. Keys are limited to the storage surface and to the backup agent routes:
This reference documents the file and folder operations plus two read-only bucket operations (list and size). Other bucket and backup routes are reachable with a key but are not part of this contract. Anything else is rejected with 403 API_KEY_SURFACE_DENIED before trial accounting runs.

​
Key lifecycle

Trial accounts must also have a verified email and may hold only one active key.

​
Authentication failures

Missing or invalid credentials return 401 through the controller error shape:
Expired keys, revoked keys, and suspended keys also fail authentication. The message text is localized; do not branch on it. Policy failures that occur after authentication use a stable code: A missing scope is a 403 from the capability guard. It does not carry one of the stable codes above, so treat any 403 without a known code as a permission problem.

​
Server-side only

API key headers are not allowed by the API’s CORS configuration. A browser request that includes them will fail preflight before it reaches a route.
Call the API from your backend, a queue worker, or a scheduled job. If a browser needs data, have your backend proxy the request and enforce your own authorization.

​
What not to do

  • Do not put keys in client-side JavaScript, mobile app binaries, or public repositories.
  • Do not share one key across unrelated services.
  • Do not use a key with broader scopes than the integration needs.
  • Do not log the secret or full header values.
  • Do not assume a dashboard session can call the REST API.

​
Next

API keys

Scopes and permissions

Requests and CORS

Rate limits