Skip to main content
Every request to the scaling.cloud API must include an API key. scaling.cloud uses Bearer token authentication — you pass your API key in the Authorization header of each request. Requests without a key, or with an invalid key, return a 401 error.

​
API keys

API keys are scoped to your organization. Any request made with your key acts on behalf of your organization. Key format:
Keep your API key private. Anyone who holds it can make API calls on behalf of your organization.

​
Get an API key

1

Open Settings

In the scaling.cloud dashboard, click Settings in the sidebar.
2

Go to API Access

Select API Access from the settings menu.
3

Create a key

Click Generate API key, give it a descriptive name, and copy the key immediately — scaling.cloud displays the full value only once.
Store your API key in a secrets manager or environment variable. Never hardcode it in source code or commit it to version control.

​
Making authenticated requests

Include your API key as a Bearer token in the Authorization header:
Example request:

​
Authentication errors

If your request is missing a valid API key, the API returns a 401 response.

​
Missing authorization header

Returned when the Authorization header is absent or does not start with Bearer .

​
Invalid API key

Returned when the token is present but invalid or expired.
The requestId field is unique to each request. Include it when contacting support to help diagnose the issue. See Errors for the complete reference on error shapes and codes.

​
Security best practices

Treat your API key like a password. Rotate it immediately if you suspect it has been exposed — generate a new key from Settings → API Access and update any integrations that use the old key.
  • Never commit keys to source control. Use environment variables or a secrets manager (such as AWS Secrets Manager or HashiCorp Vault) to inject keys at runtime.
  • Rotate keys regularly. Rotate any key that may have been exposed. Deleting a key immediately revokes all access for that key.
  • Use one key per integration. Create a separate key for each service or pipeline that needs API access. This limits the blast radius if a key is compromised and makes it easy to revoke access for a single integration without affecting others.
  • Restrict access at the org level. Only share API keys with team members who need them. Remove access for keys tied to decommissioned integrations.