Authentication

Creating a key

Dashboard → your project → API tab → name the key, pick a type, create.

The key is displayed once. Only a SHA-256 hash is stored, so it cannot be recovered or re-shown — if you lose it, revoke it and mint another.

The two key types

	Publishable	Secret
Prefix	`inkform_pk_`	`inkform_sk_`
Default scopes	`content:read`	`content:read`, `content:write`, `subscribers:read`, `subscribers:write`
Safe in a browser	Yes	No
Rate limit	120 req/min	Set by your plan — see Rate limits

Use a publishable key for anything that ships to a client. Use a secret key only where the value stays on a server you control — a backend, a build step, a CI job.

Scopes

Scope	Grants
`content:read`	Read published posts, pages, and entries
`content:write`	Create and update content (commits to your repo)
`subscribers:read`	List newsletter subscribers
`subscribers:write`	Add a subscriber (double opt-in still applies)

A request missing a required scope gets 403 naming exactly what was missing:

{ "error": "API key is missing required scope(s): subscribers:read" }

Sending a key

Either header works. Bearer is conventional:

curl "https://api.inkform.dev/api/v1/subscribers" \
  -H "Authorization: Bearer inkform_sk_your_key"

curl "https://api.inkform.dev/api/v1/subscribers" \
  -H "X-Inkform-Key: inkform_sk_your_key"

Keys are bound to one project

A key carries its project. That's why authenticated calls don't need projectId, and why a key can't be pointed at a sibling project by changing a parameter — the binding is read from the key record server-side.

To serve several projects, mint one key per project.

Revoking and deleting

Revoke leaves the record in place for audit and starts rejecting the key with 401. Delete removes it entirely. Both take effect on the next request; there's no cache to wait out.

Keys may also carry an expiry, after which they fail with 401 API key has expired.

Handling a leak

Revoke the key in the dashboard — that's the part that stops the bleeding.
Mint a replacement and deploy it.
Check the key's last used date in the API tab for activity you don't recognise.

Rotating is cheap and uneventful. Do it on a schedule, and whenever someone with access leaves.