API Keys

API keys allow your backend services to make authenticated calls to the SpartanAuth API without a user JWT — useful for administrative operations like creating invites, listing users, or managing sector settings programmatically.

Keys are created in a sector and scoped to that sector. A key created on your tenant root can administer every sector in the organization (invite users, list users, update settings on any sub-sector). A key created on a sub-sector can only administer that sub-sector. Prefer a dedicated sub-sector key for each application backend so a leaked key cannot affect your other apps. See Managing Sectors.

Creating an API key

1. In the dashboard, navigate to your sector and click API Keys
2. Click New API Key
3. Give the key a descriptive name (e.g., “Backend service - prod”)
4. Click Create and copy the key immediately — it will not be shown again

Using an API key

Include the API key in the X-API-Key header:

X-API-Key: <your-api-key>

This header is distinct from the Authorization: Bearer header used for user JWTs — you can only send one or the other per request.

Caution

Treat API keys like passwords. Store them in environment variables or a secrets manager — never hardcode them in source code or commit them to version control.

Rotating an API key

To rotate a key, create a new one, update your deployment’s environment variable to use the new key, and then delete the old key from the dashboard.

API key vs. user JWT

Property	API Key	User JWT
Issued to	Your backend service	An end user
Scope	Admin access to the sector the key was created in (tenant-root keys can administer all sub-sectors)	User’s own access
Expires	Never (until deleted)	After a configured TTL
Use case	Server-to-server operations	User requests from your frontend