Authentication

Trackee authenticates protected API routes with organization-scoped access keys.

Create an access key

1. Sign in to the Trackee dashboard.
2. Create or select an organization.
3. Enter a name for the key and choose Create key.
4. Copy the key immediately. Trackee displays the complete value only once.

Send the key

Include the key in the x-access-key request header:

curl http://localhost:3001/v1/whoami \
  -H "x-access-key: YOUR_ACCESS_KEY"

Requests without a key return 401 Missing access key. Requests with an unknown or revoked key return 401 Invalid access key.

Keep keys safe

• Store keys in environment variables or a secret manager.
• Never expose a key in browser code or commit it to source control.
• Use separate keys for separate environments.
• Revoke a key from the dashboard when it is no longer needed.