Authentication
Authentication Method
GhostMind uses Bearer token authentication for the Product API:
Authorization: Bearer sk-gm-...API Key Types
| Type | Scope | Use Case |
|---|---|---|
| Human-owned | Per user | Personal API access |
| Service-owned | Per workspace | Application integration |
Scopes
API keys can be scoped to limit access:
| Scope | Endpoints |
|---|---|
chat | /v1/chat/completions |
conversations | Conversation management |
audio | /v1/audio/* |
Security Best Practices
- Never commit API keys to version control
- Use environment variables to inject keys
- Revoke keys when no longer needed
- Use scoped keys with minimum required permissions
- Don’t expose keys in client-side code
Next Steps
- API Keys Guide — Managing keys in the web app
- Errors — Authentication error codes