Authentication

API keys

All API requests must include an Authorization header with a Bearer token:

Authorization: Bearer sk_live_...

API keys are scoped to a workspace. Each key has:

• Scopes — personas:read, personas:write, chat:read, chat:write, config:read, config:write
• IP allowlist (Enterprise) — restrict usage to specific IP ranges
• Expiry — optional expiry date

Creating an API key

Navigate to Settings → API Keys → New key in the dashboard, or use the API:

curl -X POST https://api.moonborn.co/v1/keys \
 -H "Authorization: Bearer $MOONBORN_API_KEY" \
 -d '{ "name": "production", "scopes": ["personas:read", "personas:write", "chat:write"] }'

Key prefixes

Keys are prefixed to indicate their environment:

Rate limits

Rate limit headers are included in every response:

X-RateLimit-Limit: 600
X-RateLimit-Remaining: 597
X-RateLimit-Reset: 1715432400