Authentication

The SupDesk API lives at:

https://api.supdesk.app/v1

Every request is authenticated with an API key sent as a Bearer token:

curl https://api.supdesk.app/v1/submissions \
  -H "Authorization: Bearer sd_live_..."

Creating a key

Create keys in the console under Workspace Settings → API Keys. Each key:

• is scoped to a single project — everything you read or write through it belongs to that project;
• starts with a recognizable prefix like sd_live_, so you can identify keys in config files without exposing them;
• is shown once at creation. SupDesk stores only a hash of the key — if you lose it, revoke it and create a new one.

Key handling

Treat API keys like passwords. Call the API from your servers only — the API has no CORS support, deliberately, so keys aren’t usable from browsers. If a key leaks, revoke it in the console; revocation takes effect immediately.

Failed authentication

A missing, malformed, revoked, or unknown key always produces the same response, so callers can’t probe which keys exist:

{
  "error": {
    "code": "unauthorized",
    "message": "Invalid or missing API key."
  }
}

Read vs. write access

All plans can read through the API. Write endpoints (POST, PATCH, DELETE) require the workspace to be on a paid plan Pro — on Free, writes return a 403 forbidden error. See Rate Limits & Usage.