Guides
Authentication

Authentication

Every Pluto API request authenticates with a bearer API key.

Using your key

Pass the key as a bearer token on every request:

curl https://api.joinpluto.com/v1/usage \
  -H "Authorization: Bearer sk_live_..."

Keys are prefixed sk_live_ (production), sk_test_ (test), or sk_session_ (one-time signup claim).

The TypeScript SDK will do this for you once it is published (pluto-sdk-ts, publishing soon):

// pluto-sdk-ts — publishing soon. Until then, call the REST API directly (above).
import { Pluto } from 'pluto-sdk-ts';
const pluto = new Pluto({ apiKey: process.env.PLUTO_API_KEY! });

Key facts

  • Shown once. A key's raw value is returned exactly once, at creation (signup) or when you mint a new one. Pluto stores only a hash. Lost it? Mint a replacement; the old one keeps working until you revoke it.
  • Scopes. Keys carry scopes that gate what they can do (e.g. minting new keys requires the keys:write scope). Mint least-privilege keys for each integration.
  • Environments. Keys are bound to live or test. Use a test key while developing.
  • Rotation. Create a new key, deploy it, then revoke the old one for zero-downtime rotation.

Managing keys

Create, list, and revoke keys from the dashboard (opens in a new tab) Settings page, or via the /v1/api-keys endpoints in the API Reference.

Security

  • Never commit a key to source control or ship it in a client bundle. Keep it server-side.
  • Treat the signup session_id (used once to claim your first key) as a secret too; it is the one-time credential that redeems the key.
QuickstartMCP server