Authentication

Every request to the developer platform — REST, MCP, or A2A — is authenticated with a developer key:

Authorization: Bearer exepad_dk_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Creating keys

Create keys in the Developer Console, or programmatically via POST /v1/keys (authenticated with your Studio session or an existing key that holds keys:write).

curl -X POST https://api.exepad.com/v1/keys \
  -H "Authorization: Bearer $EXEPAD_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name": "ci-deploy", "scopes": ["apps:read", "deploy:write"]}'

The response includes the full key exactly once — only a prefix and a hash are stored. Treat keys like passwords: never commit them, and rotate on suspicion of exposure.

Scopes

Keys carry an explicit scope list. Follow least privilege — mint narrow keys per use-case rather than sharing one *:* key.

Scope family	Grants
apps:read / apps:write	List/inspect apps · create, update, clone, delete
edits:read / edits:write	Edit status & logs · start AI edits
files:read / files:write	List files · upload/remove (RAG knowledge base)
deploy:read / deploy:write	Deploy status, deployments · publish, unpublish, rollback
settings:read / settings:write	— · domains, services, auth settings
observe:read	App logs, health, errors
discovery:read	Platform capabilities, services, the A2A agent card
keys:read / keys:write	List keys · mint/rotate/revoke keys
webhooks:read / webhooks:write	List webhooks & deliveries · create/manage webhooks

Wildcards are supported: *:* (everything), apps:* (a family), *:read (all reads).

Two safety properties are enforced server-side:

• Scopes are immutable — PATCH /v1/keys/{id} can rename a key but never widen its scopes.
• Delegation is subset-only — a key holding keys:write can only mint keys whose scopes are a subset of its own.

App-pinning

A key can be pinned to specific apps at creation ("apps": ["uqon8zje"]). A pinned key can only see and act on its pinned apps — everything else returns app_not_found. Use this for per-project CI keys or third-party integrations.

Key lifecycle

Operation	Endpoint
List	GET /v1/keys
Create	POST /v1/keys
Rename	PATCH /v1/keys/{id}
Rotate	POST /v1/keys/{id}/rotate — returns a new key; the old one keeps working for a 24-hour grace period
Revoke	DELETE /v1/keys/{id} — immediate

Plan requirement

Developer keys can only be minted on the Pro plan. On the free plan, key creation returns 403 with error code dev_api_not_enabled.