Authentication

An API key authenticates requests for one workspace. It uses that workspace's credits and access rules. Creating and using keys requires Enterprise; active legacy Lite workspaces retain API access.

Create a key

Open Settings > API keys in the workspace you want to use:

1. Open the key creation dialog.
2. Enter a name that identifies the integration.
3. Select the scopes it needs.
4. Select Create key.
5. Copy the full key and save it in your secret manager or local environment.

The full key is shown once. It has the form pq_live_<keyId>_<secret>; the key ID or visible prefix alone cannot authenticate requests.

Authenticate a request

Send the complete key in the Authorization header:

curl --fail-with-body --silent --show-error \
  -H "Authorization: Bearer $PROTEINIQ_API_KEY" \
  "https://proteiniq.io/api/v1/account"

This read-only request checks authentication and returns account metadata. The account response includes the workspace, available credits, and key scopes.

Key scopes

Scopes permit API operations; they do not override the key creator's workspace permissions.

• jobs:read: Read account metadata, tools, jobs, sharing settings, events, results, and accessible workflows.
• jobs:write: Quote or submit jobs, change sharing, cancel eligible jobs, and perform supported workflow writes.
• files:read: Read saved files and use saved file references as job inputs.
• files:write: Upload or delete saved files.
• projects:read: List projects and read project metadata.
• projects:write: Create, update, delete, or organize projects and their resources.

Keys created without a custom scope list receive all six scopes. Choose a smaller set when your integration needs fewer operations.

Some requests need more than one scope. Submitting a saved file requires jobs:write and files:read; assigning the new job to a project also requires projects:write.

Workspace access

A key remains bound to its original workspace. Switching workspaces in the app does not change that binding.

A resource outside the key's workspace returns not_found. Check the workspace returned by GET /api/v1/account before treating a missing job or file as deleted. Workflow access also follows the workflow publication and ownership rules.

Rotate or revoke a key

Create a replacement key, update the integration's secret, and test it with the account endpoint. Then use Revoke key on the old key in Settings > API keys.

If a key is exposed, revoke it immediately. Keep keys out of browser code, source control, notebook output, and shared logs.

Authentication errors

Use the error code to choose the next action:

• unauthorized: Check that the complete key is present and has not expired or been revoked.
• forbidden: Check API plan eligibility, scopes, and the key creator's permissions.
• not_found: Check the resource ID and the key's workspace.