Authentication
Every request must include a Bearer token in the Authorization header. Tokens are called API keys and look like sfy_wsp_live_....
Creating a key
- In your Staffify workspace, go to Settings → Developer → API keys.
- Click Create API key. Pick a name and select scopes.
- Accept the Terms of Use and click Create.
- Copy the key immediately. the plaintext is shown ONCE, then only the last 4 characters remain visible.
Using the key
curl https://app.staffifyai.com/api/workspace/v1/contacts \ -H "Authorization: Bearer sfy_wsp_live_YOUR_KEY"
Key format
sfy_wsp_live_<32-char-random>sfy_wsp_live_. fixed prefix, easy to grep for accidental commits.- Random suffix. base62, 32 characters.
- Stored server-side as SHA-256 hash. We never see the plaintext after create.
Rotate a key
Rotating generates a new key and keeps the old one working for 24 hours as a grace period. Update your integrations, then let the old key expire.
- Settings → Developer → API keys.
- Click the rotate icon on the key row.
- Copy the new key from the show-once modal.
- Update your integration within 24 hours.
Revoke a key
Revoke is immediate. any integration using the key gets 401 INVALID_API_KEY on its next request. There is no grace period.
Security best practices
- Store keys in environment variables or a secrets manager. Never commit to git or embed in client-side code.
- Prefer scoped keys. only grant
crm.contacts.writeif the integration writes contacts. See Scopes. - Set an expiry when possible. A 90-day expiry limits blast radius on leaks.
- Rotate every 6-12 months even without a suspected leak.
- Use HTTPS. The Workspace API rejects plain HTTP connections at the load-balancer.
Failed-auth throttling
After 10 failed authentication attempts from the same IP within 5 minutes, the IP is temporarily blocked with HTTP 429 for 15 minutes. This is per-IP, not per-key. a brute-force scan gets stopped early.