Authentication

Scenema authenticates every API request with a personal API key sent as an HTTP Bearer token.

The header

Send the key on every request as an Authorization header:


Authorization: Bearer sk_your_key_here

The header name is case-insensitive per HTTP convention; the value must start with Bearer followed by the raw key. The server strips the Bearer prefix, hashes the remainder, and looks the row up in constant time.

What a key looks like

Scenema keys are prefixed sk_ followed by 64 characters drawn from an alphabet the plugin picks at creation time. A full example:


sk_ONAzYeucfzSTYepxAhFAVpdoYCMQdqAmTpmbdxeRwYCYVOFQDLBhqfjXCcCzFrZC

The prefix identifies the key visually. The remainder is the secret; treat it like a password.

Key scope

Every key is anchored to the workspace that was active when you created it. Rate limits, entitlements, and credit charges follow that workspace’s plan, not the plan of whatever workspace you happen to be viewing when you make the call. Switching your active workspace in the app does not affect existing keys.

If your workspace’s plan changes (upgrade, downgrade, or cancellation via Stripe), Scenema server-side rewrites the rate limit ceiling on every key anchored to that workspace within seconds. You never need to regenerate keys to pick up a new plan’s limits.

Security posture

The plaintext key is shown exactly once, at the moment of creation. Scenema stores only a hash on the server. If you lose the plaintext you cannot recover it: revoke the key and mint a new one.

Treat keys as sensitive credentials. Store them in a password manager, a .env file that is git-ignored, or your CI provider’s secret store.
Never commit keys to source control. Never paste them into support tickets or public issue trackers.
If you suspect a key is compromised, revoke it immediately from the Settings surface. Revoked keys stop working within seconds.

Testing a key

The simplest way to confirm your key works is to hit the “list your keys” endpoint:


curl -H "Authorization: Bearer $SCENEMA_KEY" \
  https://scenema.ai/api/service/user/api-keys

HTTP 200 with a JSON body: the key is valid, enabled, and under its rate ceiling.
HTTP 401 with Unauthorized: Authentication failed: the key is unknown, disabled, or expired.
HTTP 429 with code: RATE_LIMITED and a Retry-After header: the key is valid but the workspace has hit its rate limit. All keys on the workspace share one counter. See Rate Limits.