Organizations and API Keys

Developer keys resolve to an authentication context containing org_id, key identity, owner, plan, allowed clients, expiration, and limits. API usage is metered to the key and organization context rather than a browser user session.

Client restrictions

Keys can restrict allowed_clients. Direct API calls default to client api when X-Ivorleaf-Client is omitted. If you send the header, its normalized value must be allowed for that key or the API returns 403 with API client is not allowed for this key.

Expiration and revocation

Expired keys return 403 with API key expired. Revoked or inactive keys return 403 with API key revoked. Unknown or malformed keys return 401 with Invalid API key.

Rotation

The public portal does not expose key creation, rotation, or revocation endpoints. Those operations are administrative and deliberately excluded from the developer contract. Request changes through the onboarding or support channel.