Skip to main content

Authorization header

Bearer is the only accepted authentication scheme. There is no X-API-Key, no X-Permissio-Key, no query-string fallback.

Bearer token (sandbox)
curl https://api.permissio.us/v1/envelopes \
-H "Authorization: Bearer sk_test_..."
Bearer token (production)
curl https://api.permissio.us/v1/envelopes \
-H "Authorization: Bearer sk_live_..."

If the Authorization header is missing entirely, Permissio returns 401 missing_api_key. If the value is malformed (wrong scheme, wrong prefix, expired, revoked), it returns 401 invalid_api_key. If the key is structurally valid but its sk_test_/sk_live_ prefix disagrees with the environment the key was issued for, Permissio returns 401 api_key_env_mismatch — rotate to a key for the correct environment to resolve this.