API overview

The REST API gives your code the same access you have in the dashboard. Every request acts as you, limited to the scopes you gave the key — there is no separate app account.

Quickstart

1. Create an API key

Open Dashboard → API Keys → New key, name it after the integration (e.g. Store), give it only the scopes it needs — keys:write and services:read for this guide — and set an expiry if it's temporary. The token starts with pk_ and is shown once: put it straight into your secret manager or .env.

export SANTIAUTH_API_KEY="pk_…"

2. Find your service

Every key belongs to a service, so first get its ID:

curl "https://api.santiauth.com/api/services" \
  -H "x-api-key: $SANTIAUTH_API_KEY"

Then take a provider ID from List providers (GET /api/providers?service_id=…) — or copy both IDs from the dashboard URL.

3. Issue a key

curl -X POST "https://api.santiauth.com/api/keys" \
  -H "x-api-key: $SANTIAUTH_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "provider_id": "<provider id>", "expires_in_days": 30, "key_name": "Order #1042" }'

That's the whole integration for a basic store. Next, read Errors & rate limits so a timeout never costs a buyer their key.

Authentication

https://api.santiauth.com

Send the key in the x-api-key header. Authorization: Bearer pk_… works too, if your HTTP client prefers it.

A request outside the key's scopes fails with 403. Account areas — password and 2FA, billing, settings, team members, API keys themselves — are never reachable with an API key. See Scopes.

Conventions

Responses

Every JSON response is wrapped in an envelope. On success, the payload is in data:

{
  "success": true,
  "data": { "keyId": 1, "key": "MYAPP-ABC1-DEF2-GHI3" }
}

On failure, success is false and error explains why — see Errors. DELETE endpoints that return 204 have no body. Export keys streams a file instead of JSON.

Services scope everything

Keys, providers, revenues, folders, webhooks and scripts belong to a service, so their list endpoints require a service_id query parameter and their create endpoints a service_id field. Your team members' services work the same way, within your role.

Pagination

List endpoints page in one of two ways — each endpoint's reference lists its parameters:

Fields and formats

• IDs of services, providers, revenues, folders and webhooks are integers. Key IDs are strings, obfuscated scripts use UUIDs, and Discord user IDs are snowflake strings.
• Timestamps are ISO-8601 strings in UTC, e.g. 2026-09-30T12:00:00.000Z.
• Request fields are snake_case. Most response fields are camelCase (keyId, isPremium) — check the example on each endpoint.
• Partial updates: PATCH and most PUT endpoints change only the fields you send.

OpenAPI & tools

The reference is generated from an OpenAPI 3 document. Download /openapi.json to:

• import every endpoint into Postman, Insomnia or Bruno;
• generate a typed client, e.g. npx openapi-typescript https://santiauth.com/openapi.json -o santiauth.d.ts;
• give an AI coding assistant the exact contract.

Every page here also has Copy page (top right) — it copies the page as Markdown, endpoints included, ready to paste into an LLM.

Keeping keys safe

• One key per integration — store, bot, CI — each with the narrowest scopes. Revoking one then breaks nothing else.
• Edit scopes any time in the dashboard; the change applies to the existing token immediately.
• Set an expiry for anything temporary, like a contractor's script.
• Rotate by creating the new key, deploying it, then revoking the old one.