Contact

Authentication

Every request to the public /v1 API is authenticated with an API key sent in the X-API-Key header.

curl -H "X-API-Key: enscrive_…your-key…" \
     https://api.enscrive.io/v1/corpora

Where keys come from

API keys are minted in the Enscrive developer portal by an admin of your tenant. Each key:

  • belongs to a single environment inside your tenant (see Concepts)
  • can be scoped further to a single role inside that environment
  • can be revoked or rotated from the portal

A dev key cannot see or write production data, and vice versa. When you provision a new environment, mint a fresh key for it — never share keys across environments.

Required header

The X-API-Key header is required on every request except the public documentation endpoints under /docs.

X-API-Key: enscrive_…your-key…

Missing or invalid keys return 401 Unauthorized.

Optional BYOK embedding provider header

If your tenant is configured to use a customer-supplied embedding provider key (OpenAI, Nebius, Voyage, …), pass the provider key in the X-Embedding-Provider-Key header on ingest and embedding-query calls:

curl -H "X-API-Key: enscrive_…your-key…" \
     -H "X-Embedding-Provider-Key: sk-…your-openai-key…" \
     -X POST https://api.enscrive.io/v1/ingest \
     -d '…'

Keys passed this way are used only for the single request and are never stored by Enscrive. If your tenant uses Enscrive-managed provider keys, omit this header.

Using a key with the CLI

The enscrive-cli stores keys in ~/.config/enscrive/profiles.toml and selects them via --profile <name> or the ENSCRIVE_PROFILE environment variable:

# ~/.config/enscrive/profiles.toml
default_profile = "prod"

[profiles.prod]
endpoint = "https://api.enscrive.io"
api_key = "enscrive_…your-key…"

Alternatively, pass the key inline via --api-key or ENSCRIVE_API_KEY. Environment variables take precedence over the profile; CLI flags take precedence over the environment.

Rotating keys

Rotate a key from the portal’s key management screen. Rotation issues a new key and marks the old one revoked — existing requests in flight complete against the old key, but new requests fail 401. Update your deployments with the new key before rotating.