API keys

Keys are minted from the Permissio dashboard at Settings → API keys. The prefix tells you which environment the key talks to:

Prefix	Environment
sk_test_…	Sandbox
sk_live_…	Production

Both environments share a single host (https://api.permissio.us) — the prefix is what routes the request. A key grants account-scoped access; Permissio does not currently offer per-resource scoped keys. Treat each key as a secret and store it in a secret manager.

Personal access tokens (pat_…) are dashboard-only and are rejected on /v1/* partner endpoints with 401 invalid_api_key.