Authentication - Structify

Overview

The Structify API uses API keys for authentication. You must include your API key in the Authorization header of every request.

Obtaining an API Key

Sign in to Structify Dashboard
Navigate to Settings → API Keys
Click Create New Key
Give your key a descriptive name
Copy the key immediately - it won’t be shown again

Using Your API Key

Include the API key in the Authorization header as a Bearer token:

curl -H "Authorization: Bearer YOUR_API_KEY" \
  https://api.structify.ai/server/version

from structify import Structify

# Automatically uses STRUCTIFY_API_TOKEN env var
client = Structify()

# Or provide explicitly
client = Structify(api_key="YOUR_API_KEY")

# Make authenticated requests
version = client.server.version()

import { Structify } from '@structify/prospero';

// Uses STRUCTIFY_API_TOKEN env var by default
const client = new Structify();

// Or provide explicitly
const client = new Structify({
  apiKey: 'YOUR_API_KEY'
});

// Make authenticated requests
const version = await client.server.version();

const { Structify } = require('@structify/prospero');

// Uses STRUCTIFY_API_TOKEN env var by default
const client = new Structify();

// Or provide explicitly
const client = new Structify({
  apiKey: 'YOUR_API_KEY'
});

// Make authenticated requests
client.server.version().then(version => {
  console.log(version);
});

Environment Variables

We recommend using environment variables to manage API keys:

Linux/macOS
Windows
.env file

export STRUCTIFY_API_TOKEN="your_api_key_here"

$env:STRUCTIFY_API_TOKEN = "your_api_key_here"

# .env
STRUCTIFY_API_TOKEN=your_api_key_here

Then load with python-dotenv or similar:

from dotenv import load_dotenv
load_dotenv()

Security Best Practices

Never commit API keys to version control. Add them to .gitignore:

.env
.env.local
*.key

Key Rotation

Regularly rotate your API keys:

Create a new API key
Update your applications to use the new key
Verify everything works
Delete the old key

Key Scopes

Create separate keys for different environments:

dev-key - Local development
staging-key - Staging environment
prod-key - Production only

IP Restrictions

For production keys, consider adding IP restrictions:

client.user.update(
    api_key_restrictions={
        "allowed_ips": ["192.168.1.1", "10.0.0.0/24"]
    }
)

Rate Limits

API keys have the following rate limits:

Plan	Requests/min	Burst
Free	60	100
Pro	600	1000
Enterprise	Custom	Custom

When you exceed rate limits, you’ll receive a 429 Too Many Requests response:

{
  "error": {
    "type": "rate_limit_error",
    "message": "Rate limit exceeded",
    "retry_after": 60
  }
}

JWT to API Token Exchange

For web applications using Supabase authentication, you can exchange a JWT for an API token:

# Exchange JWT for API token
response = client.user.jwt_to_api_token(jwt="your_jwt_token")
api_token = response.token

# Use the API token for subsequent requests
client = Structify(api_key=api_token)

// Exchange JWT for API token
const response = await client.user.jwtToApiToken({
  jwt: 'your_jwt_token'
});
const apiToken = response.token;

// Use the API token for subsequent requests
const client = new Structify({ apiKey: apiToken });

Troubleshooting

401 Unauthorized

Your API key is invalid or missing. Check that:

The key is correctly formatted
You’re using Bearer prefix
The key hasn’t expired or been deleted

403 Forbidden

Your API key doesn’t have permission for this operation. Check:

Key scopes and permissions
Team membership for team resources
Project access for project resources

Environment variable not working

Ensure the variable is exported:

echo $STRUCTIFY_API_TOKEN

In Python, verify it’s loaded:

import os
print(os.environ.get("STRUCTIFY_API_TOKEN"))

Next Steps

Make Your First API Call

Explore available endpoints

Python SDK Reference

Detailed Python SDK documentation

TypeScript SDK Reference

Complete TypeScript SDK guide

Rate Limits & Quotas

Understanding rate limits

​Overview

​Obtaining an API Key

​Using Your API Key

​Environment Variables

​Security Best Practices

​Key Rotation

​Key Scopes

​IP Restrictions

​Rate Limits

​JWT to API Token Exchange

​Troubleshooting

​Next Steps

Make Your First API Call

Python SDK Reference

TypeScript SDK Reference

Rate Limits & Quotas

Overview

Obtaining an API Key

Using Your API Key

Environment Variables

Security Best Practices

Key Rotation

Key Scopes

IP Restrictions

Rate Limits

JWT to API Token Exchange

Troubleshooting

Next Steps