The API supports two credential types.
API keys
For programmatic access, use an API key. Pass it either as a bearer token or in an
x-api-key header — both are accepted:
A request with neither header is rejected with a message noting the missing
x-api-key or Authorization header.
Session tokens
The desktop app authenticates with a JWT obtained at sign-in. Key-management endpoints
themselves require this session token rather than an API key — you can’t use an API key
to mint more API keys.
Managing keys
A newly created key is shown once, at creation. Store it somewhere safe — if you lose
it, revoke it and create another.
Workspaces
Requests are scoped to the team or workspace the credential belongs to. A key created
in one workspace cannot read another’s data. 
