Authentication

Everything under /v1/* (except key management itself) is authenticated with an API key, not your Stratos AI login session. This is deliberate: a key is long-lived, revocable independently of your account, and scoped to exactly what it can do — properties a login session doesn’t have.

Authorization: Bearer strat_live_a1b2c3d4e5f6...

Creating a key

Keys are created from your dashboard (https://trystratos.ai/settings?section=api) or via POST /v1/keys — the one /v1/* route that uses your real login session instead of an API key, on purpose: a key must never be usable to mint more keys or grant itself new scopes.

curl -X POST https://www.try-orbit.com/api/v1/keys \
  -H "Authorization: Bearer <your Supabase session token>" \
  -H "Content-Type: application/json" \
  -d '{"name": "my-agent", "scopes": ["apps:read", "apps:write", "content:read", "content:write", "content:approve", "credits:read"]}'

The response includes the plaintext key exactly once. Store it immediately — Stratos AI only ever shows the key’s prefix (e.g. strat_live_a1b2c3d4) after this.

Scopes

Scope	Grants
`apps:read` / `apps:write`	List/get apps · Import apps
`content:read` / `content:write`	List/get content · Create/remix content
`content:approve`	Approve or reject content
`automations:read` / `automations:write`	List/get automations · Create/pause/resume/delete
`schedules:read` / `schedules:write`	List schedules · Create/delete schedules (drafts only)
`schedules:publish`	Required in addition to `schedules:write` for `mode: "publish"` — direct posting with no draft step
`analytics:read`	Read views/likes/comments
`credits:read`	Read credit balance
`webhooks:write`	Register/list/remove webhooks

Request only what you need. A key with just content:read and analytics:read can’t generate anything, spend a credit, or touch scheduling — useful for a read-only reporting integration.

schedules:publish is a structural gate, not a policy flag: without it on the calling key, mode: "publish" can never succeed — the API rejects it before it ever reaches TikTok. Grant it only to keys that genuinely need unreviewed, live posting. See Direct publish.

Revoking a key

curl -X DELETE https://www.try-orbit.com/api/v1/keys/<key-id> \
  -H "Authorization: Bearer <your Supabase session token>"

Revocation is immediate — the next request with that key gets 401 key_revoked.

Getting Started

Guides

API Reference

Creating a key

Scopes

Revoking a key

​Creating a key

​Scopes

​Revoking a key

Creating a key

Scopes

Revoking a key