API · access
Authentication
All versioned API routes under /api/v1 require an API key before provider calls, rendering, persistence,
or usage queries run.
Headers
Send the key as a bearer token. X-Scrwly-Key is accepted as an alternative header.
Authorization: Bearer scrwly_live_xxxxx
X-Scrwly-Key: scrwly_live_xxxxx
Key storage
Keys are stored as hashes with a short prefix for identification. Admin routes can create, rotate, revoke, and
disable keys when SCRWLY_ADMIN_TOKEN is configured.