Authentication and Rate limiting

Authentication

Every request to /api/v1/* is authenticated with an API key, passed as a Bearer token in the Authorization header:

Authorization: Bearer sy_...

API keys start with sy_ and are shown in full only once — right when you create them. After that, you'll only ever see the first and last four characters. Keys expire after 30, 90 (the default), or 365 days; using an expired key returns a 401.

Create a key from Settings → Developer → API Keys. Every key is issued with a scope preset and a client-access setting:

Read-only — Read access to every resource — no writes, no publishing.

Full access — Read and write access everywhere, including publishing and team management. Reserve this for systems you fully control.

Custom — Pick read, read and write, or no access for each resource. You'll see the full list when you create the key.

All clients — The key can reach every client in your agency, including ones you add later.

Specific clients — The key is limited to a fixed list of clients you choose at creation. Requests for any other client return a 403.

Rate limiting

Rate limits apply per agency, not per key, and scale with your plan. If you're not sure what yours is, reach out to your account team.

Go over your limit and you'll get a 429 response with a Retry-After header telling you how many seconds to wait before trying again.

Every error response includes an error field describing what went wrong. Some error types add extra fields with more detail:

{
  "error": "locationId is required"
}

Status codes