Transmutify Docs

Authentication

All API requests are authenticated with organization-scoped API keys passed as bearer tokens.

Creating an API key

API keys are managed in the dashboard under API Keys. Each key belongs to your organization and grants access to your organization's schemas, providers, and transformation runs — nothing else.

The full key is shown once at creation time. Store it in a secret manager; Transmutify only keeps a hashed version and cannot show it again.

Using the key

Send the key as a bearer token in the Authorization header of every request:

cURL
curl 'https://api.transmutify.io/v1/schemas' \
  -H 'Authorization: Bearer <api-key>'

Failed authentication

Requests with a missing, malformed, or revoked key receive a 401 response with the standard error envelope:

401 Unauthorized
{
  "error": {
    "code": "unauthenticated",
    "message": "Unauthenticated.",
    "type": "authentication",
    "request_id": "9f2b4c1a-8e6d-4a3b-9c1f-7d2e5a8b3c4d"
  }
}

See Errors for the full envelope format.

Best practices

  • Use a separate key per integration so you can revoke one without breaking the others.
  • Never embed keys in client-side code — all calls should go through your backend.
  • Rotate keys periodically: create a new key, switch your integration over, then revoke the old one.