Authentication - Arcane

Create an organization API key through the Compliance Platform or the User API. The secret is returned only when the key is created. Send the key as a bearer token with every Service API request.

Authorization: Bearer <api-key>

The API key selects the organization. You do not send an organization ID in the Service API path or request body.

Use the Service API only from a trusted backend. Never put an organization API key in browser code, a mobile application, or a public repository.

Manage API keys

An authorized user manages keys through these User API methods:

Method	Path	Purpose
`GET`	`/api/api-keys`	List key metadata.
`POST`	`/api/api-keys`	Create a key and return its secret once.
`DELETE`	`/api/api-keys/{id}`	Revoke a key.

The Service API returns 401 Unauthorized when the bearer token is missing, invalid, or revoked.