Catalyte
REST API·intermediate·4 min

Authentication

Bearer tokens scoped to a workspace. How to create, rotate, and revoke API keys.

Every REST call is authenticated with a bearer token scoped to a single workspace. Tokens come in two flavors: API keys you create in the dashboard, and OAuth access tokens issued to third-party AI apps. Both are sent the same way.

Create an API key

  1. Open the dashboard and go to API keys.
  2. Click New key and give it a name.
  3. Copy the secret. It is shown once.

Keys start with the prefix cat_sk_. We store only a SHA-256 hash; if you lose a key, rotate it.

Treat keys like passwords

Never embed an API key in a public website or mobile app. Use a server-side proxy. Keys bypass user-level RLS and have full workspace privileges.

Make a request

curl https://catalyte.dev/api/public/v1/products \
  -H "Authorization: Bearer cat_sk_..." \
  -H "Content-Type: application/json"

OAuth tokens

OAuth access tokens (prefix cat_at_) are issued by the MCP OAuth flow for AI clients like Claude. They work identically in the Authorization header and respect the scopes the user granted.

Errors

  • 401 unauthorized — missing or malformed header.
  • 401 invalid_token — token doesn't exist or was revoked.
  • 403 forbidden — token is valid but lacks the scope for that action.

Rotating and revoking

Delete a key from the dashboard. It stops working within seconds across every region. For OAuth, revoke the connected app from API keys → Connected apps; the access and refresh tokens are both invalidated.

PreviousPlans & limitsNext Products API