Authentication¶

The API authenticates with API keys. Every request carries the key as a Bearer token:

Authorization: Bearer sk_live_xxxxxxxxxxxxxxxx

Create a key¶

API keys are managed in the dashboard (not via the public API):

Sign in to the dashboard.
API Keys → Create key.
Pick a scope (below) and copy the sk_live_… secret — it is shown once.

export SISTEMO_API_KEY=sk_live_xxxxxxxxxxxxxxxx

Scopes¶

Scope	Can do	Cannot do
read	`GET` requests (list/get machines, volumes, images)	Create, exec, stop/start, delete
full	Everything read can, plus create, exec, mutate, delete	—

Mutating endpoints reject a read key with 403. Use a full key with the SDKs.

Example¶

# Works with read or full:
curl https://api.sistemo.io/v1/machines \
  -H "Authorization: Bearer $SISTEMO_API_KEY"

# Requires full:
curl -X POST https://api.sistemo.io/v1/machines \
  -H "Authorization: Bearer $SISTEMO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"stack":"base"}'

Key format & security¶

Keys look like sk_live_<random>. Only the prefix and last 4 chars are stored for display — the secret itself is hashed and cannot be retrieved after creation.
Treat keys as secrets: never commit them, never ship them to browsers. Rotate by creating a new key and revoking the old one in the dashboard.
A request with a missing/invalid/revoked key returns 401.

Self-hosted¶

Optional: point the SDK/API at your own control plane with SISTEMO_BASE_URL and a key from that install. See Self-hosting (optional).