Authentication

The Scalar API uses API keys to authenticate requests. Your API key carries significant privileges, so be sure to keep it secure!

Supported methods

We support two ways to provide your API key. We recommend using the Authorization header.

Header authentication

Use the Authorization header with the Api-Key scheme. This is the standard and most secure way to authenticate.

curl -sS \
  -H 'Authorization: Api-Key scalar*live*...' \
  'https://<your-host>/api/v1/ideas/'

You can also use the X-API-Key header if your environment makes it easier to set custom headers:

curl -sS \
  -H 'X-API-Key: scalar*live*...' \
  'https://<your-host>/api/v1/ideas/'

HTTP Basic authentication

For compatibility with tools that only support Basic Auth, you can provide your API key as the username. Leave the password blank.

curl -sS \
  -u 'scalar*live*...:' \
  'https://<your-host>/api/v1/ideas/'

Error handling

If your request is missing a key or uses an invalid key, the API returns an HTTP 401 Unauthorized error.

{
    "detail": "Invalid API key."
}

If your company plan does not include API access, the API returns an HTTP 403 Forbidden error.

{
    "detail": "This feature requires a plan upgrade."
}

Security best practices

• Server-to-server only: Never use your API key in client-side code (browsers, mobile apps).
• Secret management: Store your key in an environment variable or secret manager.
• Rotation: Rotate your key immediately if you suspect it has been compromised. You can rotate your key by clicking Regenerate key in the API settings page.