API keys

The StrideHQ API uses API keys. Each key belongs to one organisation and works in one environment.

Send your key as a bearer token with every request:

curl https://api.sandbox.stridehq.ai/v1/organisation \
  -H "Authorization: Bearer $STRIDEHQ_KEY"

Every request must use HTTPS. Requests over plain HTTP are refused.

There are no tokens to exchange and nothing expires on its own. A key works until you revoke it.

API key or MCP sign-in?

Don't put an API key into an AI assistant. Use the MCP server, so every action is tied to a named person.

Create a key

Only an Owner can create keys.

1. Sign in to the app for the environment you want: app.sandbox.stridehq.ai for a sandbox key, or app.stridehq.ai for a production key. Go to Settings > Developers > API keys.
2. Select Create key.
3. Give it a name that says what uses it, for example "Xero sync" or "Data warehouse".
4. Choose the scopes it needs.
5. Copy the key. It's shown once, and StrideHQ can't show it again.

Afterwards, StrideHQ shows only the key's prefix and last four characters, so you can tell keys apart.

Key prefixes

A sandbox key only works with the sandbox address, and a production key only works with the production address. Send a key to the wrong address and you get a 401 saying which address to use.

Check your key works

Get the organisation your key belongs to. The response tells you which organisation and environment you're connected to.

curl https://api.sandbox.stridehq.ai/v1/organisation \
  -H "Authorization: Bearer $STRIDEHQ_KEY"

{
  "id": "org_1a3c5e7b9d0f4a2c6e8b0d2f4a6c8e0b",
  "object": "organisation",
  "name": "Northbrook Media",
  "base_currency": "GBP",
  "environment": "sandbox",
  "fee_rate": "2.50",
  "features": []
}

Node.js:

const res = await fetch("https://api.sandbox.stridehq.ai/v1/organisation", {
  headers: { Authorization: `Bearer ${process.env.STRIDEHQ_KEY}` },
});
const body = await res.json();
if (!res.ok) throw new Error(`${body.error.code}: ${body.error.message} (${body.error.request_id})`);
console.log(body.name, body.environment);

Python:

import os, requests

res = requests.get(
    "https://api.sandbox.stridehq.ai/v1/organisation",
    headers={"Authorization": f"Bearer {os.environ['STRIDEHQ_KEY']}"},
    timeout=30,
)
res.raise_for_status()
print(res.json()["name"], res.json()["environment"])

Keep keys safe

• Store keys in a secrets manager or your hosting provider's environment variables.
• Never put a key in code, a code repository, a browser, a mobile app, a log or a shared document.
• One key per system, so you can revoke one without breaking the others, and see which system did what.
• Server side only. Keys must never reach a browser or a customer's device.
• Least privilege. Give each key only the scopes it needs, and use sandbox keys for development.
• Don't log the Authorization header. Check your logging and error tracking tools strip it.
• Rotate keys when someone with access leaves, and at least once a year.

If you think a key has been exposed, revoke it straight away, then check its request log for anything you don't recognise.

Authentication errors

Include the request_id from the error if you contact support@stridehq.ai. Never send us your key.