> ## Documentation Index
> Fetch the complete documentation index at: https://docs.trystratos.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> strat_live_ API keys, scopes, and how they're different from your dashboard login.

Everything under `/v1/*` (except key management itself) is authenticated with an API key, not your Stratos AI login session. This is deliberate: a key is long-lived, revocable independently of your account, and scoped to exactly what it can do — properties a login session doesn't have.

```text theme={null}
Authorization: Bearer strat_live_a1b2c3d4e5f6...
```

## Creating a key

Keys are created from your dashboard (`https://trystratos.ai/settings?section=api`) or via `POST /v1/keys` — the one `/v1/*` route that uses your real login session instead of an API key, on purpose: a key must never be usable to mint more keys or grant itself new scopes.

```bash theme={null}
curl -X POST https://www.try-orbit.com/api/v1/keys \
  -H "Authorization: Bearer <your Supabase session token>" \
  -H "Content-Type: application/json" \
  -d '{"name": "my-agent", "scopes": ["apps:read", "apps:write", "content:read", "content:write", "content:approve", "credits:read"]}'
```

The response includes the plaintext key **exactly once**. Store it immediately — Stratos AI only ever shows the key's prefix (e.g. `strat_live_a1b2c3d4`) after this.

## Scopes

| Scope                                    | Grants                                                                                                |
| ---------------------------------------- | ----------------------------------------------------------------------------------------------------- |
| `apps:read` / `apps:write`               | List/get apps · Import apps                                                                           |
| `content:read` / `content:write`         | List/get content · Create/remix content                                                               |
| `content:approve`                        | Approve or reject content                                                                             |
| `automations:read` / `automations:write` | List/get automations · Create/pause/resume/delete                                                     |
| `schedules:read` / `schedules:write`     | List schedules · Create/delete schedules (drafts only)                                                |
| `schedules:publish`                      | Required *in addition to* `schedules:write` for `mode: "publish"` — direct posting with no draft step |
| `analytics:read`                         | Read views/likes/comments                                                                             |
| `credits:read`                           | Read credit balance                                                                                   |
| `webhooks:write`                         | Register/list/remove webhooks                                                                         |

Request only what you need. A key with just `content:read` and `analytics:read` can't generate anything, spend a credit, or touch scheduling — useful for a read-only reporting integration.

<Warning>
  `schedules:publish` is a structural gate, not a policy flag: without it on the calling key, `mode: "publish"` can never succeed — the API rejects it before it ever reaches TikTok. Grant it only to keys that genuinely need unreviewed, live posting. See [Direct publish](/guides/direct-publish).
</Warning>

## Revoking a key

```bash theme={null}
curl -X DELETE https://www.try-orbit.com/api/v1/keys/<key-id> \
  -H "Authorization: Bearer <your Supabase session token>"
```

Revocation is immediate — the next request with that key gets `401 key_revoked`.