REST API Authentication
Create a key in Billing → API Keys. You must be an account owner or admin,
and the account must have Carbon access. The complete sk_sootsim_... secret
appears once. Store it in your secret manager instead of source control.
Send the key as a Bearer token:
The session token created by sootsim login also authenticates /api/v1:
Session tokens have all API scopes. Browser cookies alone and GitHub
installation tokens do not authenticate /api/v1 requests.
Scopes
| Scope | Access |
|---|---|
preview_upload | Create, finalize, and inspect hosted previews |
builds | Publish and inspect customer-built snapshots for linked repositories |
test_runs | Register and list Maestro or Detox test runs |
llm | Existing AI-assisted preview and flow endpoints outside /api/v1 |
An insufficient API-key scope returns 403 insufficient_scope. An expired,
revoked, or unknown key, or an invalid session token, returns 401 unauthorized.
Key lists show the prefix, creator, scopes, creation time, expiration, and last use. Revocation takes effect immediately. Create a replacement before revoking a key when rotating automation without downtime.
