Authentication

Tenantbox uses API keys to authenticate requests. Every project gets its own API key, include it as a Bearer token on every request.

How it works

When you create a project from the dashboard, Tenantbox generates an API key. The raw key is shown only once at creation time — Tenantbox only stores a SHA-256 hash of it. If you lose it, you'll need to regenerate a new one from the project settings.

Sending the API key

Pass your API key in the Authorization header as a Bearer token on every request:

curl -X POST https://api.Tenantbox.dev/api/storage/upload/ \
  -H "Authorization: Bearer sk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{
    "tenant_id": "user_123",
    "filename": "contract.pdf"
  }'

Key scoping

Each API key is scoped to a single project. It can only read and write data belonging to that project's tenants. A key from Project A cannot access files from Project B.

Regenerating a key

If your key is compromised or you need to rotate it, go to your project page in the dashboard and click Regenerate. The old key is invalidated immediately — any integrations using it will start failing until updated.

Best practices

Error responses

Requests with a missing or invalid API key return a 401 Unauthorized response:

{
  "detail": "Unauthorized"
}