Skip to main content
Every request is authenticated with an organization API key. Keys are created in the API dashboard at app.amoreg.com: open your organization and choose API in the sidebar. A key is shown once, at creation time — store it in a secret manager. API keys are not managed in the workspace at platform.amoreg.com.
Only a SHA-256 hash of the key is stored server-side; the prefix shown in the API dashboard is for identification only.

​
Sending the key

Pass the key in the Authorization header (preferred) or X-Api-Key:

​
Scopes

Keys carry scopes limiting what they can call — pick them when creating the key in the API dashboard: A key missing the required scope receives 403 Forbidden. Keys created before the documents/executions scopes existed do not gain them automatically — create a new key to use those surfaces.

​
Errors

Revoking a key in the API dashboard takes effect immediately; in-flight screening runs started by that key still settle normally.