Skip to main content
Every request authenticates with an API key in the x-api-key header or an OAuth access token in the Authorization header. Both act for one team in your organization.

​
API keys

Response
A key belongs to the team it was created in. Requests made with it see that team’s workflows, runs and monitors, and count toward that team’s monthly spend limit.

​
OAuth access tokens

An OAuth client exchanges a signed assertion for an access token at POST /oauth/token, then sends the token as a Bearer token:
Treat the token as opaque: do not parse it or rely on its contents. It expires after the expires_in seconds given in the token response. OAuth tokens work on every endpoint that accepts an API key. An OAuth client acts for your organization’s first team, with the same team rules as a key.

​
How the API picks a credential

  • A request with Authorization: Bearer is authenticated with that token. The API ignores x-api-key on that request, even when the token is invalid.
  • An API key sent as a Bearer token is refused with 401 (Invalid bearer token or Invalid token, depending on the endpoint). Send API keys only in x-api-key.
  • Send one credential per request.
For every 401 message, see 401 Unauthorized.

​
Endpoints without credentials

Every other endpoint returns 401 without a valid credential.

​
Revocation and expiry

  • A revoked key stops working on its next request. While parts of Sixtyfour are degraded, it can keep working for up to five minutes.
  • An expired key stops working at its expiry time. Sixtyfour emails your organization before longer-lived keys expire; see Expiration.
  • Archiving a team revokes its keys.
  • Disabling or deleting an OAuth client invalidates its tokens on their next request.
When Sixtyfour cannot check a key, the request fails without being charged: billable endpoints return 503 with Retry-After: 5, and the others return 500. Retry the same request. See 503 Service Unavailable.

​
Request IDs

Every response carries an X-Correlation-ID header:
Log it with each request, and include it when you contact support. It is the Request ID column in exported usage logs.