Skip to main content

Authentication

The API authenticates with an API key. Generate one from the admin area of the product you are integrating with. Keys are prefixed sk_:

sk_xxxxxxxxxxxxxxxxxxxxxxxx

Send the key directly in the Authorization header on every request, using the Bearer scheme:

Authorization: Bearer sk_xxxxxxxxxxxxxxxxxxxxxxxx

There is no token exchange: you do not call a separate endpoint to swap the key for a short-lived token. The key itself is the credential and is validated on each request.

curl https://public-api.deliver.media/api/v1/musiccompanion/entities \
  -H "Authorization: Bearer sk_xxxxxxxxxxxxxxxxxxxxxxxx"

The key is scoped to your organisation, so all reads and writes are automatically limited to your tenant. There is no cross-tenant access.

Treat the key like a password: keep it server-side and never expose it in client-side code. Rotate it from the admin panel if it leaks.

Permissions​

  • Entity and asset endpoints require the base API permission.
  • Analysis endpoints (/api/v1/musiccompanion/analyses) require the analysis permission, which is granted separately because analysis consumes credits.

A missing or invalid key returns 401. A valid key that lacks the required permission returns 403.

Try it out​

The interactive panels in the API Reference let you call the API directly from the docs:

  1. Open an endpoint and expand Request in the right-hand panel.
  2. Expand Auth.
  3. Paste only the sk_... value into Bearer Token. Do not include the Bearer prefix and the space after it because the client adds them to the header.
  4. Complete the endpoint parameters and select Send API Request.

The key is shared across API Reference pages in the current browser tab. It is stored in session storage, so closing the tab clears it. The test client automatically targets the same environment that serves the docs: staging docs call staging, and production docs call production.