> ## Documentation Index
> Fetch the complete documentation index at: https://chatobserver.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# How do I authenticate with the chatobserver API?

> Create a workspace API key, send authentication headers, validate access, and choose the right permissions for an integration.

Create an API credential for the intended workspace in **Developer**, then send it in the `x-chatobserver-key` header or as a bearer token. Keep credentials on your server or in your integration's secret store.

The public API is served from `https://app.chatobserver.com/api`. Version 2 routes begin with `/v2`.

## Validate a visibility API credential

Store your credential in the `CHATOBSERVER_API_KEY` environment variable, then run:

```bash theme={null}
curl --fail-with-body \
  'https://app.chatobserver.com/api/v2/validate' \
  -H "x-chatobserver-key: $CHATOBSERVER_API_KEY"
```

The response identifies the credential's scopes, capabilities, and default project. Use `/v2/projects` to retrieve the associated project details.

Bearer authentication is also supported:

```bash theme={null}
curl --fail-with-body \
  'https://app.chatobserver.com/api/v2/projects' \
  -H "Authorization: Bearer $CHATOBSERVER_API_KEY"
```

Send one authentication method per request. If both headers are present, `x-chatobserver-key` takes precedence.

## Choose the required scopes

Visibility read operations require `read`. Creating or modifying prompts, brands, tags, or personas also requires `write`. Use a read-only credential for exports that do not need to change the workspace.

The [Data API](/docs/developers/data-api) requires a service-account credential and operation-specific `metrics:*` scopes. A visibility key with `write` does not automatically grant Data API access.

## Keep workspace boundaries explicit

Credentials are workspace-scoped. An optional `x-project-id` header selects the matching project; it does not grant access to another workspace. Retrieve the project identifier from the API rather than constructing it from an organisation name.

Never place a secret key in a public website, browser bundle, screenshot, or shared report. Revoke a credential when its integration no longer needs access.