API keys and scopes

CollabOS supports personal and workspace API keys from Developer settings.

API keys are scope-based. A key should only receive the scopes required for its integration.

Personal API examples include reading:

• the key owner's profile
• public raffles
• the key owner's raffle entries
• the key owner's native raffle wins

Workspace API examples include reading:

• workspace raffles
• entries for a workspace raffle
• finalized winners for a workspace raffle
• workspace projects

Authentication

Developer API requests can send the API key as a Bearer token or X-API-Key header. Keys can expire or be revoked. Secret values are not stored in recoverable plaintext after creation.

The v1 developer API enforces scopes, principal type, key status, and an application-side request limit. Production deployments should also apply edge or load-balancer rate limiting because application-instance limits do not replace network-level abuse protection.