Authentication

Programmatic calls to the Saaya API are authenticated with an API key. The key belongs to exactly one organization, and every request it makes is scoped to that organization automatically.

API keys

API keys are minted from Settings → API Keys in the dashboard at app.saaya.ai. The full key is shown once at creation and never again, only its first characters are stored for display. A key created in one organization cannot act on another.

curl https://api.saaya.ai/api/v1/agents \
  -H "X-API-Key: sa_..." \
  -H "Content-Type: application/json"

Organization scope

Saaya is multi-tenant. When you authenticate with an API key the organization is resolved from the key itself, so you do not pass an organization header. Dashboard sessions, which can belong to several organizations, select one with the X-Organization-Id header instead.

What a key cannot do

Key management is deliberately outside the reach of API keys. Creating, renaming, and deleting keys requires a signed-in dashboard session, so a leaked key cannot mint itself a successor.

Rotation

Treat keys like passwords. Rotate them on any team-membership change and immediately on suspected exposure. Keys are independent, so you can rotate without downtime: create the new key, deploy it, then delete the old key once nothing references it.