API authentication
Programmatic clients can authenticate with an organization API key using either header:
X-API-Key: YOUR_API_KEYAuthorization: Bearer YOUR_API_KEY(OpenAI-SDK-compatible)
If both are sent on the same request, X-API-Key takes precedence.
Keys use the ela_ prefix. Create and revoke keys under Settings → API Keys in the app.
A key acts as the user who created it — admin-level operations and resource
grants are checked against that person's current access — and is scoped to a
single organization. It works on almost every endpoint, including
all of /tools, /agents (creation, deployment, and imports), and
/environments and its secrets.
These still require a signed-in browser session and return 401 for a key:
/api-keys, /audit-logs, /deployments (deployment history), /fleets,
/knowledge-bases, and POST/PATCH/DELETE /registries. Each endpoint's
page in the API reference states what it accepts.
For full examples (curl, OpenAI SDK, proxy URLs), see the published API reference (API Keys and API Reference sections).