Authentication

Send your key in the Authorization header as Bearer ink_live_…. A key in a URL is refused with api_key_in_query, because URLs end up in logs. Create keys on API settings. Inkly shows a key once, so store it somewhere safe.

A key acts as the person who created it. The primary owner and Teams admins manage keys, and a workspace can have 10 live keys. The API sends no CORS headers, so call it from your server and never from a browser.

A Read key has

templates:readdocuments:read

A Read and send key has

templates:readdocuments:readdocuments:send

To check a key works, and see its workspace and scopes, call GET /me. Keep the key in an environment variable such as INKLY_API_KEY rather than in your code.

curl "https://www.inkly.so/api/v1/me" \
  -H "Authorization: Bearer $INKLY_API_KEY"

A missing, wrong, or revoked key returns 401 invalid_api_key. A key without the scope an endpoint needs returns 403 scope_required, so a Read key cannot send documents.