Authentication

The StrideHQ API needs every request to be authenticated with an API key. If a request isn't authenticated, the API returns a 401 authentication error.

API key

To authenticate a request, send your API key in this HTTP header:

Authorization: Bearer shq_test_...

Each key belongs to one organisation and works in one environment: keys starting shq_test_ work in the sandbox, and keys starting shq_live_ in production. A key's access is set by its scopes. A request the key's scopes don't cover gets a 403. To learn about each scope, continue to Scopes.

To create and manage your keys, go to API keys and Rotating and revoking keys.

AI assistants

An API key belongs to your organisation, not a person, so don't put one into an AI assistant. To connect Claude, ChatGPT or another AI assistant, use the MCP server instead. Each person signs in with their own StrideHQ login and gets their own permissions.