Authentication

The StrideHQ API uses API keys. Each key belongs to one organisation and works in one environment.

Send your key as a bearer token with every request:

curl https://api.sandbox.stridehq.ai/v1/organisation \
  -H "Authorization: Bearer $STRIDEHQ_KEY"

Every request must use HTTPS. Requests over plain HTTP are refused.

There are no tokens to exchange and nothing expires on its own. A key works until you revoke it.

API key or MCP sign-in?

Don't put an API key into an AI assistant. Use the MCP server, so every action is tied to a named person.

Create a key

Only an Owner can create keys.

1. Sign in to the app for the environment you want: app.sandbox.stridehq.ai for a sandbox key, or app.stridehq.ai for a production key. Go to Settings > Developers > API keys.
2. Select Create key.
3. Give it a name that says what uses it, for example "Xero sync" or "Data warehouse".
4. Choose the scopes it needs.
5. Copy the key. It's shown once, and StrideHQ can't show it again.

Afterwards, StrideHQ shows only the key's prefix and last four characters, so you can tell keys apart.

Key prefixes

A sandbox key only works with the sandbox address, and a production key only works with the production address. Send a key to the wrong address and you get a 401 saying which address to use.

Scopes

Give each key only the scopes it needs. A key that only reads data should only have read.

No scope can approve, fund or release a payment run, and no scope can add or change bank details. A person always does those in StrideHQ.

A request without the right scope gets a 403 with the type permission and the code missing_scope, naming the scope it needs.

Check your key works

Get the organisation your key belongs to. The response tells you which organisation and environment you're connected to.

curl https://api.sandbox.stridehq.ai/v1/organisation \
  -H "Authorization: Bearer $STRIDEHQ_KEY"

{
  "id": "org_1a3c5e7b9d0f4a2c6e8b0d2f4a6c8e0b",
  "object": "organisation",
  "name": "Northbrook Media",
  "base_currency": "GBP",
  "environment": "sandbox",
  "fee_rate": "2.50",
  "features": []
}

Node.js:

const res = await fetch("https://api.sandbox.stridehq.ai/v1/organisation", {
  headers: { Authorization: `Bearer ${process.env.STRIDEHQ_KEY}` },
});
const body = await res.json();
if (!res.ok) throw new Error(`${body.error.code}: ${body.error.message} (${body.error.request_id})`);
console.log(body.name, body.environment);

Python:

import os, requests

res = requests.get(
    "https://api.sandbox.stridehq.ai/v1/organisation",
    headers={"Authorization": f"Bearer {os.environ['STRIDEHQ_KEY']}"},
    timeout=30,
)
res.raise_for_status()
print(res.json()["name"], res.json()["environment"])

Keep keys safe

• Store keys in a secrets manager or your hosting provider's environment variables.
• Never put a key in code, a code repository, a browser, a mobile app, a log or a shared document.
• One key per system, so you can revoke one without breaking the others, and see which system did what.
• Server side only. Keys must never reach a browser or a customer's device.
• Least privilege. Give each key only the scopes it needs, and use sandbox keys for development.
• Don't log the Authorization header. Check your logging and error tracking tools strip it.
• Rotate keys when someone with access leaves, and at least once a year.

If you think a key has been exposed, revoke it straight away, then check its request log for anything you don't recognise.

Rotate a key

Each organisation can have two active keys per environment, so you can swap keys without downtime.

1. Create a new key with the same scopes.
2. Update your system to use the new key.
3. Check the old key's Last used time has stopped changing.
4. Revoke the old key.

Revoke a key

In Settings > Developers > API keys, select the key and choose Revoke. It stops working immediately. Requests that use it get a 401.

Revoking can't be undone. Create a new key if you need access again.

See what a key has done

For each key, Owners can see:

• when it was created, and by whom
• when it was last used
• the last 30 days of requests: time, endpoint, status and request ID

Every change made through the API also appears in StrideHQ's activity log as "via API", with the key's name.

Authentication errors

Include the request_id from the error if you contact support@stridehq.ai. Never send us your key.

Next steps

• Environments and sandbox: what's in the sandbox and how to move to production.
• Webhooks: get told when things change.
• API reference: every endpoint, field and error.