---
title: Authentication
description: An organization API key, sent as a bearer token. What a key may do, and how it appears in the ledger.
section: API
order: 2
---

## Make a key

A Manager makes a key in the app under **Settings**, in **API keys**, and gives it a name that says what it is for. The secret is shown **once**. Sheaf keeps only a hash of it. Revoke a key in the same place at any time; a revoked key is refused from the next request.

## Try it as a guest

No account, no password: one call opens a sandbox of your own with the sample case in it and answers with a key.

```
curl -X POST https://sheaf.us/api/guest
```

```json
{ "key": "sheaf_…", "applicationId": "AohWhGa4uo", "expiresAt": "2026-09-27T14:02:11Z",
  "requestsPerMinute": 10, "pagesIncluded": 50, "docs": "https://sheaf.us/docs/api" }
```

`applicationId` is your copy of the sample case: read it by that id (`GET /applications/{id}`, `/documents`, `/text`). `GET /applications` lists the cases you make yourself. The key acts like any organization key — read the sample, search it, upload a document of your own and run a workflow on it — within three limits:

| Limit | Value |
| --- | --- |
| Requests | 10 a minute |
| Lifetime | 24 hours, then the key is refused and the sandbox is deleted with everything in it |
| Uploads | 50 pages, across the sandbox |

The door has counters of its own: 10 sandboxes an hour from one address, 100 a day in all. A `429` means try again later, or make an account. Research and briefs in a sandbox are also capped by the hour and by the day, as for any workspace without an email. The key is shown once.

## Send it

```
Authorization: Bearer sheaf_…
```

on every call. A secret is `sheaf_` followed by 40 characters.

## What a key may do

A key acts for **one organization** with an **Originator's** rights. It can start cases, upload, run workflows and read everything in its organization.

| Request | Answer |
| --- | --- |
| Anything in another organization | 404 |
| People, keys, webhooks, passwords, the access table | 403 |
| A wrong, malformed or revoked secret | 401, even if a valid session cookie is also present |
| More than 500 requests in a minute | 429 with `Retry-After` |

## How it shows up

The ledger records what a key does under the key's name, as `LOS integration (API)`. When a workflow files documents on a run the key started, the row says `Workflow` decided, authenticated as the key. The key's row in **Settings** shows when it was last used.

## Keep it out of chat and source

Treat the secret like a password: an environment variable or a secret store. If it leaks, revoke it and make another. Nothing else has to change.