API reference

Authenticate every API request

Use scoped bearer credentials whose access follows the owner and their current workspace membership.

API reference

API key behavior

API keys belong to a user. The optional workspace restriction is an upper limit on access, while live membership and role checks remain authoritative on every request.

Read keys permit GET, HEAD, and OPTIONS. Routes that change data require a read and write key. Interactive only routes, including key management and approval decisions, reject API key authentication.

ck_live_: Production credential prefix
ck_test_: Development credential prefix
read: Allows GET, HEAD, and OPTIONS requests
read_write: Allows requests permitted by the owner role

import json
import os
import urllib.request

url = "https://api.trysupervisor.com/workspaces/{workspaceId}"
request = urllib.request.Request(url, method="GET")
request.add_header("Authorization", f"Bearer {os.environ['SUPERVISOR_API_KEY']}")
request.add_header("Content-Type", "application/json")

with urllib.request.urlopen(request) as response:
    result = json.load(response)
    print(json.dumps(result, indent=2))

Secret handling

Supervisor stores only a hash of the complete key. The settings screen cannot reveal it after creation. Rotate a credential by creating a replacement, updating the consuming service, then revoking the old key.

Do not send API keys in query strings. Query strings can appear in logs, analytics, and browser history.