Authentication
API key issuance, scopes, rotation, and troubleshooting 401s.
The API uses bearer tokens issued from the dashboard. Pass the key in the Authorization header on every request:
Authorization: Bearer ug_live_a1b2c3d4...Issuing a key
Dashboard route: Settings → API Keys → New Key. Or via the Create API key endpoint. The plaintext key is shown once — store it in a secrets manager. We store only the SHA-256 hash, so we cannot recover it for you.
The key prefix (ug_live_a1b2c3) is shown in the dashboard so you can identify which key is in use without exposing the full secret.
Format
ug_live_<48 hex chars>live_ is the only environment for now. Don't write code that parses or matches against the prefix beyond the ug_live_ literal.
Scopes
Keys are issued with full access to the resources owned by the calling account. Per-key scopes (read-only, monitor-only, status-page-only) ship in an upcoming release — issue dedicated keys per integration today and you'll have a clean migration path when scopes land.
Revocation
DELETE /api-keys/{id} revokes a key immediately. Subsequent requests with that key return 401 Unauthorized. There is no soft-delete — once revoked, gone.
Rotation
Recommended every 90 days, or whenever a developer leaves. Rotate without downtime:
- Issue a second key.
- Roll it out to your services.
- After 24h, revoke the old one.
Troubleshooting 401s
| Symptom | Likely cause |
|---|---|
401 immediately on every request | Header missing, missing Bearer prefix, or key revoked. |
| Worked yesterday, fails today | Key was revoked. Check the dashboard for active keys. |
Random 401s under load | A second key was rotated and your service still uses the old one. Check last_used_at on each key. |
401 from one machine but not another | Different env vars / .env files between machines. |
If none of those apply, email support@obzerv.xyz with the exact request, the response body, and the timestamp of the call.