Authentication

Authenticating your calls to SafetyKit

The SafetyKit API utilizes API keys for authentication. You can find your keys on your Team API Keys page.

Each API request must include your API key in an Authorization HTTP header as follows:

'Authorization': 'Bearer <api_key>'

Keep your API key confidential! Avoid sharing it, and do not include it in any code on the client-side (such as browsers, apps). Production requests need to be channeled through your backend server, where your API key can be safely retrieved from an environment variable or a key management service.

Short-lived access tokens

If you need to hand credentials to a workload where a long-lived API key would be inappropriate — such as time-boxed jobs or delegated internal services — you can exchange your API key for a short-lived access token:

curl -X POST https://api.safetykit.com/v1/access_tokens \
  -H "Authorization: Bearer <api_key>" \
  -H "Content-Type: application/json" \
  -d '{"expires_in": 900}'

The response contains the token and its expiry:

{
  "access_token": "<short_lived_token>",
  "token_type": "Bearer",
  "expires_in": 900,
  "expires_at": "2026-01-01T01:00:00.000Z"
}

Use the access_token in the Authorization header exactly like an API key. Tokens expire after expires_in seconds — the default is 3600 (1 hour), the minimum is 300 (5 minutes), and the maximum is 86400 (24 hours). You can optionally include user_id and customer_session_id in the request body to attribute the token for auditing.

Authorization results are cached, so a token may continue to authorize requests for up to five minutes after expires_at.

Short-lived access tokens cannot be used to create additional access tokens. Access token creation is not enabled for all teams — contact support@safetykit.com to enable it for yours.