Authenticate requests and check a key with /me
Send the key in a header of every request to the workspace’s host. Start with a GET /api/v1/me request to make sure the key is valid, and show the workspace’s name and scopes.
Steps
1
Find the host: the same domain you open Corteksa from in the browser.
Enterprise plan clients have their own subdomain, and the key only works on its own host.
2
Send
GET https://{HOST}/api/v1/me with Authorization: Bearer crtk_live_... or X-Api-Key: crtk_live_....3
Read the response.
A
200 carries workspace_name, workspace_id, tenant_type and scopes. Show “Connected to...”.4
Save the host and the key together, and use them in every request.
5
Treat any unexpected
401 as a disconnect: delete the saved key and ask the client for a new one.How it works
/me needs no scope, so any valid key can call it. Use scopes in the response to warn the client if a scope you need is missing.
workspace_id is null for Enterprise clients (tenant_type: dedicated), and the key still works.
Every response is wrapped in { message, data }, and pagination is in pagination at the top level.
If something goes wrong
What you see
Why
What to do
401 Missing API keyNo header.
Send
X-Api-Key or Authorization.401 Invalid or expired API keyThe key is revoked, expired or wrong.
Ask for a new key.
401 on the right host with a sound keyThe key belongs to a workspace on another host.
Use the host of the workspace where the key was created.
Good to know
120 requests a minute per key.
A request without a key returns
401.Did this guide solve it?
If not, we’ll ask what was missing.