SpoolisDocs

Spoolis docs

Authentication

Use a scoped production API key for v1 routes or a short-lived sandbox bearer token for sandbox routes.

Production API keys

Production API keys begin with spk_live_ and are managed at /dashboard/api-keys. The full key is shown once. Send it in the bearer authorization header.

HTTP
Authorization: Bearer spk_live_<key>

Key scopes

Full keys can use the complete production lifecycle, including operations that require human-authorized settlement authority.

Verify keys can create one-call verification results, submit evidence, and run verification before settlement is committed.

Counterparty keys are bound to one Spool. They can read that Spool, accept or decline it, and submit evidence while its outcome is active. They cannot create, commit, fund, verify, or list events.

Authentication errors

A missing, unknown, or revoked production key returns HTTP 401 with this JSON shape.

JSON
{
  "error": "Invalid API key",
  "code": "unauthenticated",
  "retryable": false,
  "remediation": "Provide a valid Spoolis API key in the Authorization header.",
  "field": "headers.authorization",
  "docs": "https://spoolis.com/docs/api"
}

Sandbox bearer tokens

Routes under /api/sandbox/* use short-lived bearer tokens minted by POST /api/sandbox/session. Sandbox tokens are separate from production API keys.

Rate limits

See the API reference for implemented limits and response behavior.

Authentication · Spoolis