Authentication

The public API supports two authentication strategies. Both use the Authorization: Bearer <token> header.

Strategy	Use case	Token source
JWT	First-party clients (web app, mobile app) acting as a signed-in user	Issued by `/auth/login`; expires; refreshable
API key	Server-to-server integrations and CLI tools	Created in Workspace settings → API keys

API key requests

Set N24M_API_KEY in your shell to your workspace API key (from Workspace settings → API keys) before running the examples below.

curl --request GET \
  --url 'https://api.not24get.me/api/v1/me' \
  --header "Authorization: Bearer ${N24M_API_KEY}"

API keys are scoped to a single workspace. For workspace-scoped operations (anything under /workspaces/...), include the workspace ID:

curl --request GET \
  --url 'https://api.not24get.me/workspaces/WORKSPACE_ID/folders' \
  --header "Authorization: Bearer ${N24M_API_KEY}" \
  --header 'X-Workspace-ID: WORKSPACE_ID'

If X-Workspace-ID is missing on a workspace-scoped endpoint, the server uses the key's default workspace. If the key has no default and the header is missing, the request fails with validation_error.

JWT requests

JWTs are issued by /auth/login. Pass the access token in Authorization: Bearer .... Refresh it before it expires by calling /auth/refresh.

JWTs already encode the active tenant and account; you do not pass X-Workspace-ID. To switch workspace context within the session, call the workspace-switch endpoint and re-issue the token.

Common headers

Header	Direction	Purpose
`Authorization: Bearer <token>`	Request	Required on every authenticated endpoint
`Content-Type: application/json`	Request	Required for `POST`/`PATCH` with a body
`X-Workspace-ID`	Request	Selects the workspace for API key requests
`X-Correlation-ID`	Request	Optional; if present, echoed back so you can correlate logs
`X-RateLimit-Limit`	Response	Requests allowed per window. See Rate limits
`X-RateLimit-Remaining`	Response	Requests left in the current window
`X-RateLimit-Reset`	Response	Epoch seconds when the window resets
`X-Correlation-ID`	Response	Always present; copy it into bug reports

Security expectations

API keys are hashed at rest. Once the secret leaves the Create key dialog, it cannot be retrieved — only revoked and reissued.
Use the principle of least privilege: scope keys to a single workspace, set short expiries, and revoke promptly.
Rotate keys at least quarterly. Use separate keys for separate integrations so revocations are surgical.