Authentication and workspace scope
Authenticate with a bearer key that automatically scopes every request to one workspace.
Every data request requires:
Authorization: Bearer <api-key>API keys contain 43 Base64URL characters. Do not add quotes around key.
Sonik resolves API key to its workspace and scopes request automatically. Clients do not send workspaceId.
| Situation | Result |
|---|---|
| Missing, malformed, or unknown API key | 401 Unauthorized |
| Resource outside token workspace | 404 Not Found |
Key lifecycle
- One active API key exists per workspace.
- Workspace admins can view and copy current key from Sonik integration settings.
- Key is encrypted at rest and revealable only from admin integration page.
- Public data endpoints never return key.
- Regeneration immediately invalidates old key.
- Old and new keys do not overlap.
- Regeneration cannot be rolled back.
Store key in CRM backend or server-side secret manager. Never embed it in frontend code, browser storage, mobile application, logs, URLs, screenshots, or source control.
ReadMe Try It is a manual testing exception: key is entered temporarily on a trusted device and request goes directly to Sonik. Do not use browser-side API calls in shipped integrations.
Updated 9 days ago
Did this page help you?