Authentication

The Studio API accepts API keys and, when enabled by your deployment, OAuth access tokens. API keys support automation and the SDKs. OAuth lets the CLI and registered applications act on your behalf with permissions you approve.

Studio supports two types of API keys — personal keys and workspace keys — each with different billing and access behaviors.

Key Types

Generating API Keys

To generate a personal key, open Account settings → Studio API keys. Workspace administrators can create shared keys from Workspace settings → Studio API keys.

Using API Keys

Pass your API key in the X-API-Key header with every request:

curl -X POST https://agent-studio.seeyu.ai/api/v2/workflows/{workflowId}/execute \
  -H "Content-Type: application/json" \
  -H "X-API-Key: YOUR_API_KEY" \
  -d '{"input": {}}'

const response = await fetch(
  'https://agent-studio.seeyu.ai/api/v2/workflows/{workflowId}/execute',
  {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'X-API-Key': process.env.STUDIO_API_KEY!,
    },
    body: JSON.stringify({ input: {} }),
  }
)

import os
import requests

response = requests.post(
    "https://agent-studio.seeyu.ai/api/v2/workflows/{workflowId}/execute",
    headers={
        "Content-Type": "application/json",
        "X-API-Key": os.environ["STUDIO_API_KEY"],
    },
    json={"input": {}},
)

Workspace Scoping

Every request that names a workspace is checked against the key's own scope before any data is read. The two key types are scoped differently:

• A workspace key can only ever reach its own workspace. If a request names a different workspaceId, the API answers 403 with API key is not authorized for this workspace and stops there — no query runs, and the response reveals nothing about whether the other workspace exists. This holds on every endpoint of every API version, and it is not something a workspace admin can grant around.
• A personal key reaches a workspace only when that workspace allows it. Each workspace has an Allow personal API keys setting. With it off, a personal key is refused with 403 and Personal API keys are not allowed for this workspace, even when its owner is a member. With it on, the key is still held to its owner's permission level on that workspace — a read endpoint needs read, a write endpoint needs write — and a key whose owner has neither is refused with 403 and Access denied.

A 403 never tells you whether a resource exists in the workspace you could not reach. Resources are always resolved inside workspaceId, so a conversation or contact that lives in another workspace is reported as 404 not found rather than as denied.

Where Keys Are Used

API keys authenticate access to:

• Workflow execution — run deployed workflows via the API
• Logs API — query workflow execution logs and metrics
• MCP servers — authenticate connections to deployed MCP servers
• Chat API — read and write conversations, messages, contacts, and teams in a workspace inbox
• SDKs — the Python and TypeScript SDKs use API keys for all operations

OAuth access tokens

Use studio login to authorize the CLI in your browser, or studio login --read-only to request read access. For hosted Studio, add --endpoint https://agent-studio.seeyu.ai; the CLI saves the endpoint with the login. The CLI stores the login locally and refreshes access tokens automatically. See CLI authentication for profiles, sign-in, and sign-out.

Registered OAuth applications send access tokens in the Authorization header:

curl https://agent-studio.seeyu.ai/api/v2/workspaces \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN"

Scopes limit what an application may do; your current workspace membership and role still apply. Each endpoint documents its required scope. Some GET endpoints that perform external discovery require api:write, so HTTP method alone does not determine the permission.

Manage grants in Settings → General → Authorized apps. Revoking an application signs out all of its logins. studio logout revokes the current CLI login and removes it from your machine. The Python and TypeScript SDKs currently use API keys; they do not manage OAuth sign-in or refresh tokens.

Security

• Keys use the sk-studio- prefix and are encrypted at rest
• Keys can be revoked at any time from the dashboard
• Use environment variables to store keys — never hardcode them in source code
• For browser-based applications, use a backend proxy to avoid exposing keys to the client