Authentication

API keys are bound to one workspace and sent as a bearer token.

Every request carries an API key in the Authorization header:

curl https://api.thinkout.io/v1/accounts \
  -H "Authorization: Bearer $THINKOUT_API_KEY"

Keys and workspaces

A key belongs to exactly one workspace. There is no workspace parameter in the URL: the key decides which workspace you read. To read several workspaces, create one key per workspace.

Keys are created by workspace owners and managers in ThinkOut under Settings. The full key is shown once at creation. Store it in a secrets manager and never in client-side code or a public repository.

Permissions

A key can list and fetch every resource of its workspace and nothing else. Version 1 exposes only reads, and there is no scope selection.

Rotation and revocation

Revoke a key from the same settings page. Revocation is immediate: the next request with that key returns 401. Create the replacement key first, deploy it, then revoke the old one.

Failure responses

Status	error.code	Meaning
401	unauthorized	The header is missing, malformed, or the key is unknown or revoked.
403	forbidden	The key is valid but the workspace is inactive.

See Errors for the envelope.