Skip to content
Trusty Sweep Developers

API keys

Create keys per application in the developer console (POST /v1/developer/applications/{id}/keys). The secret is shown once.

Authorization: Bearer sk_live_…   # production
Authorization: Bearer sk_test_…   # isolated test tenant
  • Scopes are fixed at creation and cannot exceed the application’s allowed operation classes. See Scopes.
  • A developer key acts on end-user state only through a connection (connection_id=cxn_…) created by Sweep Connect, and only within that connection’s grant.
  • Rotate with POST …/keys/{keyId}/rotate (old key valid 24 hours) and revoke with DELETE …/keys/{keyId}.
  • Keys are hashed at rest. Store them in a secret manager; never ship them to browsers.