API authentication
Use scoped Bearer keys for server-to-server calls
Create keys in Developer → API Keys. The sk_live_ secret is returned only at creation. Invalid or revoked keys return 401; insufficient scopes return 403.
Secret handling
Keep API keys server-side and never commit them or place them in browser JavaScript.
Code Examples
curl http://localhost:8080/api/v1/chats \
-H "Authorization: Bearer $PARRISCOPE_API_KEY"Scopes
The middleware checks route-specific permissions.
- chats:read — GET /api/v1/chats
- messages:write — POST /api/v1/messages/send
- contacts:write — POST /api/v1/contacts
- tickets:write — POST /api/v1/tickets
- read, write, admin, and * are broader grants