API keys are issued by the Planally team. To request one, contact support@planally.com:
Send the key as a Bearer token on every request:
Authorization: Bearer <api-key>
Requests without this header, using a different scheme, or presenting an unknown/invalid key are rejected with 401 Unauthorized.
A key stops working (401) as soon as any of the following is true, even before its expiry date:
Every authenticated request updates the key's last-used timestamp, so hitting any endpoint (including a GET) counts as usage.
A Read-only key will be rejected if it tries to make a change. If your key expires, is disabled, or the user it belongs to is removed, the key will stop working.
| Permission | Allowed |
|---|---|
| Read | All GET endpoints |
| Read & write | All GET endpoints, plus PATCH / DELETE where available |
Calling a write endpoint (PATCH/DELETE) with a Read-only key returns 403 Forbidden with body:
This API key does not have write permission.
That body is plain text, not JSON. See Conventions for the different error body shapes used across the API.