Skip to main content
Every request to the Stairoids public API is authenticated with your organization’s API key, sent in the X-Api-Key header. Your organization has a single public API key. It grants read access to your organization’s data across every endpoint in this reference — there are no per-key scopes or roles to configure.

​
Get your API key

  1. Open the Stairoids dashboard.
  2. Go to Settings and find your public API key.
  3. If you don’t have one yet, generate it, then copy the value — treat it like a password.
Until your organization generates a key, the public API is disabled for it. Generate one to start making requests.

​
Send the key

Pass the key in the X-Api-Key header on every request. Don’t use an Authorization: Bearer header — that scheme isn’t used here.
For POST endpoints, also send Content-Type: application/json alongside your JSON body.

​
Rotate your key

Rotate your key periodically — and immediately if it may have been exposed. Regenerating the key from your dashboard settings issues a new value and immediately invalidates the old one, so update your integrations with the new key as part of the rotation.

​
Error responses

A 401 for a missing or invalid key is rejected before the request reaches an endpoint, so it carries no body. Once authenticated, endpoints report problems with a small JSON body carrying a machine-readable code — for example, a resource that isn’t in your pipeline comes back as a 400: