Sheaf
Authentication
An organization API key, sent as a bearer token. What a key may do, and how it appears in the ledger.
Make a key
A Manager makes a key in the app under Settings, in API keys, and gives it a name that says what it is for. The secret is shown once. Sheaf keeps only a hash of it. Revoke a key in the same place at any time; a revoked key is refused from the next request.
Try it as a guest
No account, no password: one call opens a sandbox of your own with the sample case in it and answers with a key.
curl -X POST https://sheaf.us/api/guest
{ "key": "sheaf_…", "applicationId": "AohWhGa4uo", "expiresAt": "2026-09-27T14:02:11Z",
"requestsPerMinute": 10, "pagesIncluded": 50, "docs": "https://sheaf.us/docs/api" }
applicationId is your copy of the sample case: read it by that id (GET /applications/{id}, /documents, /text). GET /applications lists the cases you make yourself. The key acts like any organization key — read the sample, search it, upload a document of your own and run a workflow on it — within three limits:
| Limit | Value |
|---|---|
| Requests | 10 a minute |
| Lifetime | 24 hours, then the key is refused and the sandbox is deleted with everything in it |
| Uploads | 50 pages, across the sandbox |
The door has counters of its own: 10 sandboxes an hour from one address, 100 a day in all. A 429 means try again later, or make an account. Research and briefs in a sandbox are also capped by the hour and by the day, as for any workspace without an email. The key is shown once.
Send it
Authorization: Bearer sheaf_…
on every call. A secret is sheaf_ followed by 40 characters.
What a key may do
A key acts for one organization with an Originator's rights. It can start cases, upload, run workflows and read everything in its organization.
| Request | Answer |
|---|---|
| Anything in another organization | 404 |
| People, keys, webhooks, passwords, the access table | 403 |
| A wrong, malformed or revoked secret | 401, even if a valid session cookie is also present |
| More than 500 requests in a minute | 429 with Retry-After |
How it shows up
The ledger records what a key does under the key's name, as LOS integration (API). When a workflow files documents on a run the key started, the row says Workflow decided, authenticated as the key. The key's row in Settings shows when it was last used.
Keep it out of chat and source
Treat the secret like a password: an environment variable or a secret store. If it leaks, revoke it and make another. Nothing else has to change.