Authentication

Send your API key as a bearer token:

curl -H "Authorization: Bearer $SPUTNIK_TOKEN" \
  "https://sputnikintelligence.com/api/v1/posts?limit=5"

Create one in the app under Settings → API keys. The key is shown once, at creation. We store only a hash, so if you lose it we cannot recover it — create a new one and revoke the old.

A key belongs to a team, not to you

This is the part worth understanding. A key acts for the team it was created in, permanently — never whichever team its creator happens to have open in the web UI.

If you belong to two teams, you hold two keys. Neither one can see the other team's collections, projects or alerts. That is deliberate: a key sitting in a script should not change what it can reach because a human clicked something in a browser.

A key stops working, with a 403, if its creator leaves that team or the team is deleted.

What a key can reach

Data	Who can read it
Posts, people, publications, topics, sponsors	Any authenticated team. The corpus is shared.
Global collections	Any authenticated team. Curated by us, editable by nobody.
Your collections, projects, alerts, webhooks	Only the key's team.

Revoking

Revoke a key from the same page you created it on. It stops working immediately — there is no cache to wait out. Rotating means creating the new key, moving your callers over, then revoking the old one.

MCP is different

The MCP server authenticates you as a signed-in user through the browser, not with an API key, and an API key does not work against it. If your agent runs somewhere that cannot complete an interactive sign-in — a scheduled job, a container — use the REST API with a key.