Authentication and permissions
API keys
Section titled “API keys”An API key belongs to you and to your workspace. Send it in the Authorization header:
Authorization: Bearer wai_…- The secret is shown once, when you create the key. Waalaxy AI only stores a hash of it.
- A key can have an expiration date. Without one, it is valid until you revoke it.
- Revoking a key in Settings › API & MCP takes effect immediately.
Permissions
Section titled “Permissions”A key never grants more than your role in the workspace, and it follows your role when it changes.
| Endpoints | Who can read them |
|---|---|
/v1/team |
Owners and Admins |
/v1/billing |
Owners |
| Everything else | Every role |
The API is read-only: it never creates, updates or deletes anything in your workspace.
Workspace
Section titled “Workspace”A key reads the workspace it was created in. If you move to another workspace, create a new key there.