Authentication

Every request carries your workspace's API key as a Bearer token. The key acts as you, in that workspace, with everything you can do in the app.

#Keys

Create a key in the app at Settings → API. A key has full access to the workspace. Revoke it there and it stops working on the next request.

Format	`attria_sk_` followed by 40 letters and digits
Shown	Once, when you create it. Attria stores only a hash, so it can't show it again.
Acts as	The member who created it, in that workspace. Work it makes lands there, as if you'd made it in the app. If that member leaves the workspace, the key stops working.
Billing	Calls spend the workspace's credits, the same as the app.

#Sending the key

Put it in the Authorization header on every request:

Header

Authorization: Bearer attria_sk_…

curl "https://app.attria.io/api/v1/me" \
  -H "Authorization: Bearer $ATTRIA_API_KEY"

const res = await fetch("https://app.attria.io/api/v1/me", {
  headers: {
    Authorization: `Bearer ${process.env.ATTRIA_API_KEY}`,
  },
});
const me = await res.json();

import os, requests

res = requests.get(
    "https://app.attria.io/api/v1/me",
    headers={
        "Authorization": f"Bearer {os.environ['ATTRIA_API_KEY']}",
    },
    timeout=30,
)
me = res.json()

A missing, malformed or revoked key gets a 401:

Response401

{
  "error": {
    "type": "authentication",
    "message": "Send your API key as `Authorization: Bearer attria_sk_…`. Create one in Settings → API."
  },
  "request_id": "9b2f0c1e-5d47-4a8e-b3a6-2c1d0e9f8a77"
}

#Keeping it safe

Keep it on a server or in your agent's environment — never in a browser bundle, a mobile app or a public repo.
Read it from an environment variable (ATTRIA_API_KEY in every example here).
If it leaks, revoke it in Settings → API and create a new one. The old one stops working immediately.

The key has full access to the workspace — the same as signing in. Treat it like a password.

#MCP uses the same key

The MCP server takes the same Authorization: Bearer header, so one key covers your code and your agents.